Implementation Specialist, CMMC at Secureframe · LumiJobs

Responsibilities

As an Implementation Specialist focused on CMMC, you will lead customer implementations and deliver hands-on technical remediation for defense customers preparing for CMMC Level 2 assessments. You will configure and administer Microsoft 365 GCC High and Azure Government environments, implement and validate security controls, and help customers develop the documentation and evidence needed for assessment readiness.
This customer-facing role combines project leadership, Microsoft systems administration, security engineering, and CMMC expertise. You will serve as the primary implementation owner, manage multiple engagements, troubleshoot technical issues, and translate compliance requirements into working configurations and repeatable operating procedures. You will execute technical work within the agreed scope and coordinate with customer IT teams and external partners on shared responsibilities and specialized remediation.
Lead end-to-end CMMC implementations from discovery and scoping through environment configuration, control validation, documentation, readiness milestones, and operational handoff.
Translate customer requirements into implementation plans with clear scope, timelines, milestones, owners, risks, dependencies, and success criteria; communicate progress and drive accountability across multiple engagements.
Translate CMMC Level 2 and applicable NIST SP 800-171 requirements into implementation tasks, identify control gaps, and execute remediation. Help customers operationalize CUI and FCI handling, asset categorization, evidence collection, and assessment preparation.
Map where controlled unclassified information (CUI) and federal contract information (FCI) live across email, file sharing, cloud applications, endpoints, engineering systems, specialized equipment, facilities, and third-party providers; document system boundaries and control ownership.
Configure Secureframe workflows for control mapping, evidence automation, policies, procedures, owner assignments, remediation tracking, and readiness reporting. Document technical configurations and control evidence, and contribute to System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and assessment preparation.
Provision, harden, and administer Microsoft 365 GCC High tenants and Azure Government resources, including virtual machines, storage, Azure Virtual Desktop, backups, and monitoring.
Configure Microsoft Entra ID, Conditional Access, multifactor authentication, role-based access, and Privileged Identity Management. Administer Windows Server, Active Directory Domain Services, Group Policy, DNS, and hybrid identity synchronization; configure Microsoft Entra Domain Services where appropriate.
Deploy and manage Microsoft Intune for device enrollment, configuration profiles, security baselines, endpoint compliance, encryption, application deployment, and patching.
Implement Microsoft Sentinel data connectors, log collection, analytics rules, dashboards, alert tuning, and incident-response automation.
Configure Microsoft Defender and Purview for endpoint protection, vulnerability management, data loss prevention, sensitivity labeling, and protection of CUI.

Qualification

You are a builderYou are customer-centered and pragmaticYou are resourceful with modern toolsYou must qualify as a UExperience with Azure GovernmentNetworking expertiseExperience supporting C3PAO assessmentsWhy This Role Matters

Required

You are a builder. You enjoy creating structure where it does not yet exist, documenting what works, improving rough processes, and helping a new team scale beyond heroic one-off delivery.
You are comfortable with ambiguity and early-stage operating environments. You can make progress with incomplete information, identify the next best step, and keep customers moving without waiting for every answer to be perfect.
You are proficient with PowerShell and can automate administration and configuration tasks.
You can work with a wide range of customers, from founder-led teams with minimal IT capacity to larger organizations managing multiple departments, frameworks, facilities, and stakeholders.
You are customer-centered and pragmatic. You can explain complex compliance and technical concepts in plain language and help customers make decisions that fit their business, risk, and timeline.
You communicate clearly in writing and live meetings, including project plans, status updates, executive summaries, implementation risks, and internal feedback.
You are resourceful with modern tools, including AI, and interested in building smarter workflows for implementation delivery.
You must qualify as a U.S. person under ITAR (22 CFR § 120.62) for work involving export-controlled customer data and environments. U.S. residence or work authorization alone does not establish U.S. person status. [Draft requirement: Tyler to confirm applicability and final wording before publication.]

Preferred

Experience with Azure Government, AWS GovCloud, DFARS 252.204-7012, FedRAMP, ITAR, or defense contractor environments.
Experience in security operations center (SOC) monitoring, alert triage, incident investigation and response, and supporting DFARS 252.204-7012 cyber incident reporting workflows, including the 72-hour reporting requirement.
Networking expertise, including Azure Firewall or third-party firewalls, VPNs, routing, network security groups, and segmentation.
Experience supporting C3PAO assessments, partner-assisted delivery, secure enclaves, or implementing GRC and compliance automation platforms.
Relevant certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), Certified CMMC Professional (CCP), or Certified CMMC Assessor (CCA); other project management, security, or GRC credentials such as PMP, CSM, Security+, CISA, CISM, CRISC, or CCSK are also a plus.
Experience building implementation playbooks, service packages, onboarding programs, or customer delivery operations from an early stage.
Why This Role Matters
CMMC is becoming a market-access requirement for thousands of companies that support the defense ecosystem. Many of these customers are not large defense primes with mature compliance teams. They are aerospace manufacturers, IT services firms, engineering companies, construction suppliers, security providers, universities, and specialized small businesses that need a practical way to prove readiness without losing focus on their core business.

Implementation Specialist, CMMC

Responsibilities

Qualification

Required

Preferred

Company

Secureframe

More roles at Secureframe