Implementation Specialist, CMMC

Secureframe•New York, NY

5d•Remote

About The Position

At Secureframe, we are at the forefront of revolutionizing cybersecurity compliance. As a growing company, our mission is to provide seamless, secure compliance solutions. The Implementation team works closely with various departments to help customers achieve real operational readiness for CMMC assessments. This is an early role on a new team where the individual will help define excellent CMMC implementation processes, create playbooks, and contribute to a scalable implementation motion. As an Implementation Specialist focused on CMMC, you will lead hands-on implementation projects for customers pursuing CMMC and related defense readiness requirements. You will be the primary customer-facing owner for implementation execution, coordinating internal teams, external partners, and customer stakeholders. This role requires strong project leadership, technical fluency, customer empathy, and comfort operating in ambiguity, assisting customers with understanding scope, CUI and FCI handling, SSP and POA&M workflows, asset categorization, evidence expectations, secure environment decisions, partner responsibilities, and C3PAO readiness.

Requirements

2-5 years of experience in implementation, professional services, customer success, project management, technical consulting, GRC, security compliance, or a similar customer-facing delivery role.
Builder mentality: enjoy creating structure, documenting processes, improving processes, and helping a new team scale.
Comfortable with ambiguity and early-stage operating environments; able to make progress with incomplete information and identify next steps.
Strong project-management instincts: ability to manage timelines, dependencies, risks, executive visibility, and cross-functional accountability.
Technically fluent enough to discuss identity, endpoints, cloud environments, logging, access control, asset inventory, network boundaries, and secure collaboration with IT and security stakeholders.
Understanding of, or motivation to quickly learn, CMMC, NIST SP 800-171, CUI, FCI, SSPs, POA&Ms, evidence management, audit readiness, and the defense industrial base.
Ability to work with a wide range of customers, from small teams with minimal IT capacity to larger organizations.
Customer-centered and pragmatic approach: ability to explain complex concepts in plain language and help customers make decisions that fit their business, risk, and timeline.
Clear written and verbal communication skills, including for project plans, status updates, executive summaries, and internal feedback.
Resourceful with modern tools, including AI, and interested in building smarter workflows for implementation delivery.

Nice To Haves

Experience with CMMC, NIST SP 800-171, DFARS 252.204-7012, FedRAMP, ITAR, GCC High, Azure Government, AWS GovCloud, or defense-sector customers.
Experience implementing or administering GRC platforms, compliance automation tools, ticketing systems, identity providers, MDM, EDR, SIEM, cloud collaboration suites, or secure enclave environments.
Experience in professional services, managed services, security consulting, audit readiness, or partner-assisted delivery.
Project management certification, security certification, or GRC certification such as PMP, CSM, Security+, CISA, CISM, CRISC, CCSK, or equivalent practical experience.
Experience building implementation playbooks, service packages, onboarding programs, or customer delivery operations from an early stage.

Responsibilities

Lead end-to-end CMMC implementations for new and existing Secureframe customers, owning the customer experience from kickoff through handoff and readiness milestones.
Translate customer requirements into clear implementation plans, including scope, timeline, milestones, owners, risks, dependencies, and success criteria.
Help customers understand and operationalize CMMC requirements, including Level 1 FCI basics, Level 2 CUI handling, NIST SP 800-171 control expectations, SSP and POA&M workflows, evidence collection, asset inventory, and audit-readiness preparation.
Partner with customers to identify where CUI lives today across email, file sharing, cloud applications, endpoints, engineering systems, specialized equipment, facilities, and third-party providers.
Coordinate implementation work across Secureframe product configuration, control mapping, evidence automation, policies, procedures, owner assignments, remediation tracking, and readiness reporting.
Support secure-environment planning discussions, including identity, endpoint management, logging, network segmentation, GCC High or Azure Government considerations, Google Workspace hardening, virtual desktops, physical controls, and partner-led remediation where relevant.
Work with Sales and Customer Success to improve pre-sale scoping, implementation estimates, customer expectation-setting, and handoff quality.
Collaborate with CMMC partners, MSPs, consultants, auditors, and C3PAOs while maintaining clear boundaries around Secureframe's role in preparation, platform tooling, implementation support, and independent assessment.
Deliver live customer training and working sessions that help customers assign owners, collect evidence, remediate gaps, and use Secureframe as their operating system for CMMC readiness.
Build repeatable implementation assets, including kickoff templates, project plans, RACI models, discovery questionnaires, evidence checklists, status reports, readiness criteria, risk registers, and handoff runbooks.
Identify patterns across implementations and feed those insights back to Product, Engineering, Sales, Customer Success, and leadership.
Use AI and automation thoughtfully to accelerate repeatable implementation work, summarize customer context, surface risks, and improve time to value.