[Hiring] Security Compliance Consultant @Ascera

Own The Role:

SP6 is looking for a Compliance SME wanting to take the next step in their career! In this role, you will assist organizations in solidifying and strengthening their security posture while also conducting assessments for those pursuing certification.

Joining our Compliance team, you will see your impact across the company as you take ownership over customer projects and advising our platform team on the different compliance rules.    

From there, you will be supporting Defense Industrial Base (DiB) companies to ensure they are CMMC and/or NIST 800-171 compliant. You will accomplish this through providing pre-audit readiness and GAP assessments, plans of action and milestones (POA&M) support, Compliance as a Service (CaaS), and official C3PAO assessments.   

How You’ll Drive Success:

Advisory Services

• Leading cybersecurity gap assessments aligned with NIST SP 800-171 and Cybersecurity Maturity Model Certification (CMMC). 
• Supporting the day-to-day activities of engagements for external clients, as a contributing member of SP6’s customer-facing Cyber Risk & Compliance practice.
• Assist external customers in their FedRAMP, DFARS 7012, CMMC, and NIST 800-171 compliance initiatives.  
• Applying cyber compliance / risk management knowledge, control principles and technical knowledge across cyber risk and compliance engagements.   
• Consulting with end clients to gather requirements and understand our clients' key business and security challenges. Working with team members to advise on practical and cost-effective solutions to help mitigate our clients’ cybersecurity risks and challenges. 
• In depth knowledge of relevant security regulatory compliance requirements and translating those into business processes and security controls to enhance and support client’s compliance and audit capabilities.   
• Articulating and defending IT controls testing approach and performing test of design and operating effectiveness.
• Develop and deliver training to internal teams and customers.   
• Establishing and maintaining effective working relationships with colleagues, existing clients, and prospective client organizations.  
• Supporting the ASCERA product team and advising them on SP6’S NIST continuous monitoring software.

C3PAO Assessments

• Conducting formal assessments of organizations’ cybersecurity practices using the CMMC assessment process (CAP).
• Collaborate with client organizations to plan assessments, develop assessment schedules, and ensure readiness
• Assess the effectiveness of security practices and ensure they align with the CMMC practices and processes.
• Interview key personnel within the organization to understand how cybersecurity practices are implemented and maintained.
• Evaluate sufficiency and adequacy of evidence to verify implementation.
• Maintain an objective and unbiased stance during the assessment process, ensuring that conclusions are based on facts and evidence.
• Ensure that all documentation is properly prepared for submission to eMASS if the organization is seeking certification.

Requirements

To Be Successful:

• CMMC Certified Assessor (CCA) or Certified Professional (CCP).
• CISSP, CISM, CISA, CRISC or other related certification.
• 2 minimum years of experience testing and documenting IT security controls including experience managing and facilitating external IT audits.
• 2 minimum years of experience leading external or internal audits, e.g., CMMC, FedRAMP, ISO 27001, PCI.
• 2 minimum years of experience building security programs in alignment with NIST, CSF, NIST 800-53 and/or NIST 800-171.
• 2 minimum years of experience with Cloud Security.
• Self-driven, with a strong desire to succeed.
• Ability to engage with customers/executives and foster positive relationships.
• Exceptional communicator and ability to relay complex technical concepts to non-technical audience.

Benefits

Why SP6?

• The chance to be part of a winning team and a premier C3PAO.
• Competitive salary.
• Quarterly Bonus plan.
• Employer-paid health insurance.
• 401(k) with company match.
• 30 days annual paid time off.
• Significant Training and Development and Certification attainment.
• Opportunity for long term career advancement.
• Your contributions are felt and recognized at our growing company.

About SP6/ASCERA:

SP6 is an industry recognized C3PAO (Certified Third-Party Assessor Organization) dedicated to assisting organizations in effectively identifying and managing cyber risks while ensuring compliance with industry standards, federal laws, and regulations.

SP6 has developed, ASCERA, a powerful automation tool bringing security and compliance teams closer together by providing real-time testing of security controls to determine effectiveness and gather system generated evidence.

About the company

SP6 is a niche consulting and software firm with expertise in two overlapping yet distinct domains: Security and cyber compliance.

SP6’s legacy expertise is with log management and security analytics, as well as analytics for technology operations. SP6 emerged as one of the leading North American partners of Splunk, recognized by Gartner as the leader in log management, security analytics (including SIEM), and data analytics.

SP6 is also a CMMC Third-Party Assessor Organization accredited by the Cyber AB home to Certified CMMC Professionals & Assessors regarded as experts in their field. With a deep knowledge of CMMC/DFARS and other relevant security frameworks, our team offers personalized consulting that meets your organization wherever it is in maturity.

ASCERA by SP6 is next-generation compliance software focused on leveraging automation to minimize the pain of manual, administrative, and time-consuming tasks associated with security compliance.

Our solution isn’t a GRC, it’s superpowers for your GRC. With ASCERA you can:

✅ Save hundreds of hours collecting evidence with automated, nearly real-time collection of evidence for 59% of controls.

✅ Significantly increase the likelihood of passing your CMMC C3PAO assessment with ASCERA’s built-in guidance features.

✅ Automatically pull critical security-related information from your SIEM to assess and continuously monitor your compliance status.