Senior Cybersecurity Compliance Consultant (US Remote)

Intelligent Technical Solutions

7h•$95,000 - $120,000•Remote

About The Position

The Security Advisor (Senior Cybersecurity Compliance Consultant) delivers active security practice management engagements, serving as the assigned security officer (vCISO) for a portfolio of client organizations. The role combines hands-on compliance delivery with client relationship ownership, risk management, and ongoing security advisory work. The role requires subject matter expertise across regulatory compliance frameworks, strong client-facing communication, and organizational discipline to manage a high volume of concurrent engagements. This position sits at the senior end of the practice: it carries the most complex and highest-regulatory-risk engagements in the portfolio and sets the technical standard for the practice's compliance deliverables.

Requirements

CISSP (active and in good standing) — required at time of hire. This is a hard requirement: commitments to obtain, lapsed or Associate-level credentials, and equivalent-experience substitutions will not be considered.
CMMC ecosystem credentials required: CCP (Certified CMMC Professional) active at time of hire, with CCA (Certified CMMC Assessor) required within the first 12 months. Registered Practitioner (RP) status alone does not satisfy this requirement.
Minimum eight (8) years of progressive information security experience, including at least three (3) years delivering compliance or vCISO engagements across a multi-client portfolio in a consulting, MSP, or MSSP environment or something similar.
Demonstrated ownership of at least two (2) completed CMMC Level 2 readiness engagements, or equivalent NIST SP 800-171 assessment work, including SSP authorship and POA&M management through to third-party assessment.
Documented working depth in a minimum of three (3) distinct regulatory frameworks — surface familiarity across many frameworks is not a substitute for demonstrated depth.
Experience defending deliverables and control determinations directly to auditors, third-party assessors, or regulators.
U.S. person status (U.S. citizen or lawful permanent resident) required due to access to Controlled Unclassified Information (CUI) under DFARS flow-down obligations.
U.S.-based remote with reliable availability across U.S. business time zones; occasional travel to client sites for assessment support.
Working command of cybersecurity principles and practices, including compliance standards and regulations such as CMMC / NIST SP 800-171 and 800-171A, NIST SP 800-53, NIST CSF 2.0, HIPAA / HITECH, SOC 2, PCI DSS v4.0, FTC Safeguards Rule, GLBA, ISO/IEC 27001 / 27002, and CIS Controls v8.
Familiarity with the federal contracting compliance stack — DFARS 252.204-7012, 7019, 7020 and 7021, FAR 52.204-21, CUI marking and handling per 32 CFR Part 2002, and the phased CMMC rule.
Awareness of adjacent privacy and sector regimes: U.S. state privacy laws, GDPR, NY DFS Part 500, SEC cyber disclosure obligations, and CJIS.
Proficiency in incident response and threat mitigation strategies.
Ability to conduct comprehensive risk assessments and map findings to security controls.
Experience building and maintaining remediation plans (POA&Ms) and mitigation strategies.
Familiarity with cybersecurity tools and technologies (e.g., SIEM, EDR/XDR, IDS/IPS, firewalls), with Microsoft security stack experience preferred.
Experience with GRC and compliance platforms (e.g., IntelliGRC, Vanta, Secureframe, Drata, Onetrust, FutureFeed) and evidence-collection workflows.
Ability to manage a high volume of concurrent client engagements (20–30 relationships) with disciplined prioritization.
Strong scheduling and follow-through; proficiency with PSA/ticketing and project tracking tools.
Ability to work within — and improve — standardized templates and delivery processes.
Excellent communication skills for interacting with client stakeholders from IT staff to executives; ability to translate technical findings into business terms.
Ability to build and maintain strong client relationships and work effectively with coordinators and a distributed team.
Ability to track and report on engagement metrics, compliance status, and deliverable progress.
Proficiency in generating clear client-facing and executive-level reports.
Expertise in monitoring regulatory compliance and refining security policies and procedures based on industry best practices.
Commitment to staying current on emerging trends and technologies in cybersecurity, the CMMC ecosystem, and evolving compliance requirements.
Participation in industry training, conferences, and credential maintenance.

Nice To Haves

Additional certifications a plus: CISM, CRISC, CISA, GIAC (GSLC, GCCC), CompTIA Security+, Security X, Microsoft SC-series.
CCA (Certified CMMC Assessor) required within the first 12 months.
Registered Practitioner (RP) status alone does not satisfy this requirement.

Responsibilities

Serve as the assigned security officer (vCISO) for a portfolio of client engagements: lead recurring meeting cadences, act as the primary point of contact for clients' cybersecurity concerns and provide regular updates and reports on the status of security initiatives, including performance metrics, findings, and recommendations for improvement.
Build strong client relationships, understand each client's unique regulatory and business requirements, and address their needs with tailored strategies and security roadmaps.
Identify above-contract demand and security program growth opportunities within assigned accounts, surfacing right-sizing and expansion recommendations to practice leadership ahead of contract renewal.
Track and maintain contract health ensuring that issues with delivery are communicated early.
Lead CMMC Level 1 and Level 2 readiness engagements: NIST SP 800-171 control assessments, System Security Plan (SSP) development, POA&M creation and management, SPRS score submission support, evidence collection, and client preparation for third-party assessment.
Advise clients on CUI scoping, DFARS 252.204-7012 and FAR 52.204-21 obligations, and enclave architectures, including Microsoft GCC High environments.
Deliver compliance engagements across additional frameworks as assigned, including HIPAA / HITECH, SOC 2 (Types I and II), PCI DSS v4.0, FTC Safeguards Rule, GLBA, ISO/IEC 27001 and 27002, NIST Cybersecurity Framework 2.0, NIST SP 800-53, CIS Critical Security Controls v8, and AI governance (NIST AI RMF, ISO/IEC 42001).
Advise on sector- and state-specific regimes as engagements require, including NY DFS 23 NYCRR Part 500, SEC cybersecurity disclosure rules, CJIS Security Policy, StateRAMP / FedRAMP readiness, and U.S. state privacy laws (CCPA/CPRA and successors) alongside GDPR and ISO/IEC 27701 where clients have international exposure.
Map overlapping control sets across frameworks to build unified control matrices, eliminating duplicate evidence collection across a client's concurrent compliance obligations.
Conduct comprehensive risk assessments to identify potential threats and vulnerabilities, develop and implement mitigation strategies to enhance clients' security postures, and monitor compliance with regulatory requirements and industry standards, recommending remediation actions to address gaps or deficiencies.
Oversee data collection efforts to verify compliance and gather critical security information within client infrastructures, ensuring accuracy and reliability.
Review and interpret security tooling outputs across the Microsoft security stack (Defender XDR, Sentinel, Entra ID Protection, Intune, Purview, Conditional Access) and coordinate remediation with client IT teams and internal engineers.
Perform general Security Officer duties, such as running security huddles, supporting cyber insurance questionnaires and attestations, and ensuring security tool functionality for assigned clients.
Assist with incident response (IR) activities, including possibly participating in the on-call incident escalation rotation, supporting SOC coordinators, communicating with key stakeholders during incidents, contributing to playbooks, and conducting postmortems with clients.
Maintain accurate, timely time entries in the PSA (ConnectWise Manage); delivered hours are the practice's operational and financial source of truth.
Contribute to scalable templates, engagement processes, and the practice knowledge base, fostering a culture of continuous improvement and knowledge sharing.
Serve as an escalation resource on advanced framework interpretation and control-determination questions, and support quality review of compliance deliverables prior to client or assessor submission.
Stay informed about emerging threats, vulnerabilities, and regulatory changes — including the DoD's phased CMMC rollout — assessing their potential impact on clients and adjusting strategies accordingly.