Qureos Mentor

Trident Research

The Governance, Risk, and Compliance (GRC) Officer / CUI Manager ensures the organization&rsquo;s compliance with DFARS 252.204-7012, NIST SP 800-171, and CMMC (Cybersecurity Maturity Model Certification) requirements. This position is responsible for the protection, management, and oversight of Controlled Unclassified Information (CUI) within the company&rsquo;s environment. The GRC Officer / CUI Manager develops and enforces governance policies, conducts risk assessments, manages the organization&rsquo;s System Security Plan (SSP) and Plan of Action and Milestones (POA&amp;M), and leads efforts to achieve and maintain CMMC certification. This role is critical in safeguarding the company&rsquo;s systems and data supporting DoD and DLA contracts.Governance, Risk &amp; Compliance<ul><li>Lead company-wide compliance initiatives related to DFARS 252.204-7012, NIST SP 800-171, and CMMC Level 2 and/or Level 3, as required by contract.</li><li>Develop, implement, and maintain cybersecurity policies, standards, and procedures aligned with federal defense contracting requirements.</li><li>Maintain and update the System Security Plan (SSP), POA&amp;M, and other compliance documentation.</li><li>Conduct internal gap analyses and readiness assessments for CMMC certification.</li><li>Coordinate with third-party assessors, auditors, and government representatives for audits and reviews.</li><li>Monitor regulatory updates and ensure continuous alignment with DoD cybersecurity and CUI protection requirements.</li></ul>Risk Management<ul><li>Conduct and maintain organizational risk assessments and maintain a current risk register.</li><li>Collaborate with IT and Operations to identify, evaluate, and mitigate risks related to the confidentiality, integrity, and availability of CUI.</li><li>Support incident response planning and reporting, ensuring compliance with DFARS 252.204-7012 incident reporting timelines and procedures.</li><li>Assist with vendor risk management, ensuring subcontractors meet equivalent cybersecurity requirements.</li></ul>CUI Program Management<ul><li>Serve as the organization&rsquo;s CUI Manager, responsible for the identification, marking, handling, storage, transmission, and destruction of CUI in accordance with DoD 5200.48 and NARA guidance.</li><li>Establish and maintain a CUI Protection Program including procedures, training, and enforcement mechanisms.</li><li>Ensure CUI is properly labeled and protected throughout its lifecycle, including in digital and physical formats.</li><li>Conduct CUI awareness and training programs for employees and contractors.</li><li>Maintain an inventory of CUI repositories and oversee access control measures to ensure only authorized personnel handle CUI.</li><li>Coordinate with IT and Security teams to ensure technical controls (e.g., encryption, access management, audit logging) adequately protect CUI.</li></ul>Continuous Monitoring &amp; Improvement<ul><li>Implement a continuous monitoring strategy for cybersecurity controls and compliance posture.</li><li>Manage vulnerability assessments, control testing, and remediation activities.</li><li>Track metrics for compliance, risk reduction, and CUI incidents, reporting results to senior leadership.</li><li>Lead tabletop exercises and training programs to ensure readiness for cyber incidents and audits.</li></ul>Collaboration &amp; Communication<ul><li>Act as the primary liaison between internal departments, external partners, and government representatives for all compliance and CUI-related matters.</li><li>Provide guidance and support to business units handling DoD contracts to ensure contractual cybersecurity clauses are properly implemented.</li><li>Educate and train personnel on compliance responsibilities, cybersecurity awareness, and CUI handling procedures.</li></ul>Requirements:Required:&middot; Bachelor&rsquo;s degree in Cybersecurity, Information Assurance, Computer Science, or related field or 7-10 years of experience in leu of degree.&middot; Minimum 5&ndash;7 years of experience in governance, risk, and compliance roles within a defense contracting or DoD-regulated environment.&middot; Strong working knowledge of:o DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting);o NIST SP 800-171, 32 CFR Part 170, 48 CFR Part 204 Subpart 204.75 CMMC Rule; ando DoD Instruction 5200.48 (CUI Policy).&middot; Proven experience managing or maintaining System Security Plans (SSPs), POA&amp;Ms, and audit documentation.&middot; Experience leading or supporting CMMC or NIST 800-171 self-assessments.&middot; Strong communication, policy development, and audit preparation skills.&middot; Active DoD Secret Clearance or eligibility to obtain one.Preferred:&middot; Certifications such as CISM, CISSP, CCP (CMMC Certified Professional), or CCA (CMMC Certified Assessor).o Candidates with CISSP-ISSEP/ISSAP or CMMC CCP/CCA certifications are strongly preferred.&middot; Familiarity with FedRAMP, RMF (Risk Management Framework), NIST SP 800-53, and/or 32 CFR Part 117 National Industrial Security Program (NISP).&middot; Experience implementing or managing GRC tools and compliance automation systems.Job Type: Full-timePay: $100,000.00 - $130,000.00 per yearBenefits:<ul><li>401(k)</li><li>401(k) matching</li><li>Dental insurance</li><li>Employee assistance program</li><li>Employee discount</li><li>Health insurance</li><li>Health savings account</li><li>Life insurance</li><li>Paid time off</li><li>Parental leave</li><li>Professional development assistance</li><li>Referral program</li><li>Retirement plan</li><li>Tuition reimbursement</li><li>Vision insurance</li></ul>Work Location: In person

Governance, Risk, and Compliance Officer/CUI Manager

Join Trident Research and explore 1   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Trident Research

ABOUT_COMPANY

Governance, Risk, and Compliance Officer/CUI Manager