{"id":3983369,"url":"https://alion.io/job/secureframe-implementation-specialist-cmmc-2","title":"Implementation Specialist, CMMC","company":{"id":6300,"name":"Secureframe","domain":"secureframe.com","url":"https://alion.io/company/secureframe","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":95,"open_postings":5,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":124,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Solutions","role_family":"Solutions","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":100000,"max":125000,"currency":"USD","period":"year","gross":null,"usd_annual":125000},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"CMMC","optional":false},{"name":"DNS","optional":false},{"name":"Google Workspace","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"NIST 800-171","optional":false},{"name":"PowerShell","optional":false},{"name":"SOC 2","optional":false},{"name":"VPN","optional":false},{"name":"Windows","optional":false},{"name":"Windows Server","optional":false},{"name":"AWS","optional":true},{"name":"FedRAMP","optional":true}],"status":"live","first_seen_at":"2026-11-09T19:37:00Z","employer_posted_date":"2026-11-09","last_verified_at":"2026-11-09T20:43:27Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Secureframe\nSecureframe helps organizations build, automate, and prove trust through modern security, compliance, and risk programs. Our platform helps customers manage evidence, policies, controls, vendors, personnel, assets, and audit readiness across frameworks including SOC 2, ISO 27001, NIST 800-171, and CMMC.\nWe are expanding deeper into the defense industrial base with our CMMC product. For many customers, CMMC is not just a compliance requirement. It is the path to winning or retaining contracts with the Department of Defense, primes, aerospace and defense companies, government agencies, and regulated commercial buyers. Our opportunity is to make CMMC implementation faster, clearer, and more operational for companies that cannot afford to turn a lean team into a full-time compliance department.\nAbout the Implementation Team\nThe Implementation team sits within Secureframe's customer organization and works closely with Sales, Customer Success, Product, Engineering, Security, Support, and our partner ecosystem. This team is responsible for helping customers move from signed contract to real operational readiness: scoped environments, configured platform workflows, clear control ownership, evidence collection, remediation tracking, and a credible path to CMMC assessment.\nThis is an early role on a team we are building from scratch. The right person is not only comfortable delivering customer implementations; they want to help define what excellent CMMC implementation looks like at Secureframe. You will create playbooks, improve handoffs, identify repeatable delivery patterns, pressure-test service packaging, and help turn early customer engagements into a scalable implementation motion.\nAbout the Role\nAs an Implementation Specialist focused on CMMC, you will lead customer implementations and deliver hands-on technical remediation for defense customers preparing for CMMC Level 2 assessments. You will configure and administer Microsoft 365 GCC High and Azure Government environments, implement and validate security controls, and help customers develop the documentation and evidence needed for assessment readiness.\nThis customer-facing role combines project leadership, Microsoft systems administration, security engineering, and CMMC expertise. You will serve as the primary implementation owner, manage multiple engagements, troubleshoot technical issues, and translate compliance requirements into working configurations and repeatable operating procedures. You will execute technical work within the agreed scope and coordinate with customer IT teams and external partners on shared responsibilities and specialized remediation.\nWhat You'll Do\nLead end-to-end CMMC implementations from discovery and scoping through environment configuration, control validation, documentation, readiness milestones, and operational handoff.\n\nTranslate customer requirements into implementation plans with clear scope, timelines, milestones, owners, risks, dependencies, and success criteria; communicate progress and drive accountability across multiple engagements.\n\nTranslate CMMC Level 2 and applicable NIST SP 800-171 requirements into implementation tasks, identify control gaps, and execute remediation. Help customers operationalize CUI and FCI handling, asset categorization, evidence collection, and assessment preparation.\n\nMap where controlled unclassified information (CUI) and federal contract information (FCI) live across email, file sharing, cloud applications, endpoints, engineering systems, specialized equipment, facilities, and third-party providers; document system boundaries and control ownership.\n\nConfigure Secureframe workflows for control mapping, evidence automation, policies, procedures, owner assignments, remediation tracking, and readiness reporting. Document technical configurations and control evidence, and contribute to System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and assessment preparation.\n\nProvision, harden, and administer Microsoft 365 GCC High tenants and Azure Government resources, including virtual machines, storage, Azure Virtual Desktop, backups, and monitoring.\n\nConfigure Microsoft Entra ID, Conditional Access, multifactor authentication, role-based access, and Privileged Identity Management. Administer Windows Server, Active Directory Domain Services, Group Policy, DNS, and hybrid identity synchronization; configure Microsoft Entra Domain Services where appropriate.\n\nDeploy and manage Microsoft Intune for device enrollment, configuration profiles, security baselines, endpoint compliance, encryption, application deployment, and patching.\n\nImplement Microsoft Sentinel data connectors, log collection, analytics rules, dashboards, alert tuning, and incident-response automation.\n\nConfigure Microsoft Defender and Purview for endpoint protection, vulnerability management, data loss prevention, sensitivity labeling, and protection of CUI.\n\nSupport secure network configurations and coordinate firewall, VPN, segmentation, and connectivity changes with customer IT teams and partners. Bridge on-premises infrastructure with GCC High, Azure Government, and secure enclaves, including hybrid identity, controlled data flows, access boundaries, and connectivity validation. Account for physical controls and non-Microsoft systems, including Google Workspace, where relevant to customer scope.\n\nWork with Sales and Customer Success to improve pre-sale scoping, implementation estimates, customer expectation-setting, and handoff quality.\n\nProvide advisory support on CMMC scope, secure architecture, control gaps, and remediation priorities, translating technical and compliance tradeoffs into practical recommendations for customer stakeholders.\n\nCollaborate with CMMC partners, MSPs, consultants, auditors, and C3PAOs while maintaining clear boundaries around Secureframe's role in preparation, platform tooling, implementation support, and independent assessment.\n\nDeliver customer training and technical working sessions that help administrators operate their environments, troubleshoot issues, assign control owners, collect evidence, and maintain readiness. Provide documented procedures and an operational handoff to customer teams and Customer Success.\n\nBuild repeatable implementation assets, including kickoff templates, project plans, RACI models, discovery questionnaires, evidence checklists, status reports, readiness criteria, risk registers, and handoff runbooks.\n\nIdentify patterns across implementations and feed those insights back to Product, Engineering, Sales, Customer Success, and leadership.\n\nAutomate deployment, administration, configuration, and evidence collection using PowerShell, Microsoft Graph, and Azure tooling. Use AI and automation thoughtfully to streamline repeatable delivery work, surface risks, and improve time to value.\n\nWhat Success Looks Like\nCustomers know exactly what they need to do, who owns each workstream, and how Secureframe supports their path to readiness.\n\nCustomers have scoped environments, configured and validated controls, documented procedures, assigned evidence owners, and clear remediation plans. Administrators can operate the implemented environment after handoff.\n\nSecureframe develops a repeatable CMMC implementation motion that can serve very small businesses, SMBs, mid-market companies, and more complex defense contractors without reinventing the process every time.\n\nSales and Customer Success have sharper implementation packaging, better scoping inputs, and more confidence setting customer expectations.\n\nProduct and Engineering receive clear feedback on what CMMC customers actually need to deploy, prove, and maintain readiness.\n\nAbout You\nYou have 2-5 years of relevant experience in technical implementation, Microsoft systems administration, security engineering, professional or managed services, or technical consulting, including customer-facing delivery.\n\nYou are a builder. You enjoy creating structure where it does not yet exist, documenting what works, improving rough processes, and helping a new team scale beyond heroic one-off delivery.\n\nYou are comfortable with ambiguity and early-stage operating environments. You can make progress with incomplete information, identify the next best step, and keep customers moving without waiting for every answer to be perfect.\n\nYou have strong project-management and troubleshooting judgment and can manage multiple customer engagements, timelines, dependencies, risks, executive visibility, and cross-functional accountability.\n\nYou have demonstrated production experience administering Microsoft Azure, Microsoft 365 GCC High, and Windows environments, with strong knowledge of Active Directory Domain Services, Entra ID, Group Policy, DNS, hybrid identity, and Microsoft domain services.\n\nYou have direct experience deploying and troubleshooting Microsoft Sentinel and Intune, and configuring Microsoft Defender and Purview security and data-protection capabilities.\n\nYou are proficient with PowerShell and can automate administration and configuration tasks.\n\nYou bring strong CMMC Level 2 expertise and hands-on experience delivering readiness or remediation engagements, including implementing and validating applicable NIST SP 800-171 controls, control mapping, SSPs, POA&Ms, documentation, and assessment evidence.\n\nYou can work with a wide range of customers, from founder-led teams with minimal IT capacity to larger organizations managing multiple departments, frameworks, facilities, and stakeholders.\n\nYou are customer-centered and pragmatic. You can explain complex compliance and technical concepts in plain language and help customers make decisions that fit their business, risk, and timeline.\n\nYou communicate clearly in writing and live meetings, including project plans, status updates, executive summaries, implementation risks, and internal feedback.\n\nYou are resourceful with modern tools, including AI, and interested in building smarter workflows for implementation delivery.\n\nYou must qualify as a U.S. person under ITAR (22 CFR § 120.62) for work involving export-controlled customer data and environments. U.S. residence or work authorization alone does not establish U.S. person status. [Draft requirement: Tyler to confirm applicability and final wording before publication.]\n\nNice to Have\nExperience with Azure Government, AWS GovCloud, DFARS 252.204-7012, FedRAMP, ITAR, or defense contractor environments.\n\nExperience in security operations center (SOC) monitoring, alert triage, incident investigation and response, and supporting DFARS 252.204-7012 cyber incident reporting workflows, including the 72-hour reporting requirement.\n\nNetworking expertise, including Azure Firewall or third-party firewalls, VPNs, routing, network security groups, and segmentation.\n\nExperience supporting C3PAO assessments, partner-assisted delivery, secure enclaves, or implementing GRC and compliance automation platforms.\n\nRelevant certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), Certified CMMC Professional (CCP), or Certified CMMC Assessor (CCA); other project management, security, or GRC credentials such as PMP, CSM, Security+, CISA, CISM, CRISC, or CCSK are also a plus.\n\nExperience building implementation playbooks, service packages, onboarding programs, or customer delivery operations from an early stage.\n\nWhy This Role Matters\nCMMC is becoming a market-access requirement for thousands of companies that support the defense ecosystem. Many of these customers are not large defense primes with mature compliance teams. They are aerospace manufacturers, IT services firms, engineering companies, construction suppliers, security providers, universities, and specialized small businesses that need a practical way to prove readiness without losing focus on their core business.\nSecureframe is in a strong position to help these customers because CMMC work touches areas our pl...","description_format":"text","description_chars":12553,"description_truncated":true,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-11-09T20:43:27Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"green card filings: 1","filings_12m":0,"filings_prev_12m":0,"green_card_filings_12m":1,"median_offered_wage_usd":252500,"route":null,"cap_exempt":false,"checked_at":"2026-11-09T07:32:21+00:00","sources":["US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":124,"reasons":["conf:2","win:early","comp:junior"],"computed_at":"2026-11-09T22:44:56Z"},"pay":{"stated_usd_annual":125000,"is_top_pay":true},"html_url":"https://alion.io/job/secureframe-implementation-specialist-cmmc-2","json_url":"https://alion.io/job/secureframe-implementation-specialist-cmmc-2.json","meta":{"generated_at":"2026-11-09T22:44:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12670,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6300},"rest":"https://alion.io/mcp/rest/get_company?id=6300"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsecureframe-implementation-specialist-cmmc-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsecureframe-implementation-specialist-cmmc-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsecureframe-implementation-specialist-cmmc-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/secureframe-implementation-specialist-cmmc-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsecureframe-implementation-specialist-cmmc-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3983369}},{"tool":"search_jobs","arguments":{"company":"secureframe.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3983369},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}