IT Security & Compliance Lead

CBRE Government & Defense Services•,

1d•$160,000 - $180,000•Hybrid

About The Position

This position requires a strong understanding of security program and control frameworks, assessment methodologies, and practices, such as NIST 800-171, CMMC, NIST RMF, NIST CSF, ISO 27001/2, and FedRAMP. The role also demands a solid grasp of data controls and compliance regimens involving CUI, export control, and data privacy. Experience with cybersecurity programs in the Defense and/or Federal/Civilian sectors, along with experience in conducting security assessments, is essential. The ability to communicate technical security concepts to non-technical audiences and experience leading compliance programs are key. Effective program management, project management, and organization management skills are also required.

Requirements

7+ years of experience in an IT security or compliance role
3+ years of experience working directly with CMMC and/or DFARS -7012 compliance
2+ years writing policies, requirements, or similar documents
Bachelor's degree or 4+ years of experience in a relevant field
Advanced understanding of security program and control frameworks, assessment methodologies, and practices e.g. NIST RMF, NIST CSF, ISO-27001, 800-53, 800-171, CMMC, CNSSI 1253, 800-137, PCI-DSS, GDPR, HITRUST, etc.
Advanced understanding of data controls and compliance regimens including CUI, ITAR/ EAR, PCI, PII, etc.
Ability to communicate technical security concepts to non-technical audiences
Effective program management, project management, and organization management skills

Nice To Haves

Certification such as Certified Information Systems Security Professional (CISSP) or the Certified Information Systems Auditor (CISA) preferred.

Responsibilities

Maintain a strong understanding of security program and control frameworks, assessment methodologies, and practices, e.g., NIST 800-171, CMMC, NIST RMF, NIST CSF, ISO 27001/2, and FedRAMP.
Possess a strong understanding of data controls and compliance regimens involving CUI, export control, and data privacy.
Leverage experience with cybersecurity programs in the Defense and/or Federal/Civilian sectors.
Utilize experience with the conduct of security assessments.
Communicate technical security concepts to non-technical audiences.
Lead compliance programs.
Apply effective program management, project management, and organization management skills.