CMMC Compliance Officer

• Education: Bachelor's degree (Computer Science, Cybersecurity, Information Technology) with six years of Information Security or related experience, or a master’s degree with three years of relevant security experience.

• Certifications: CCP, CISA, & CompTIA Security+ preferred
• Experience: Strong skills in project management, problem solving, and value creation. Proficiency in Microsoft Suite and MS Project. Must Experience in architectural projects and execution.
• Additional Qualifications:
• Must be a U.S. citizen
• Must be able to obtain and maintain an Active U.S. Government security clearance.
• Demonstrated understanding of secure information system design, implementation and maintenance is required.
• Strong knowledge of policy development & enforcement, continuous monitoring, and risk management/assessment practices.
• Excellent verbal and written communication. Strong interpersonal skills as required to effectively collaborate with customers, cybersecurity professionals and fellow associates.

• Extensive experience with NIST SP 800-171 and CMMC 2.0 requirements.
• Extensive experience with audit preparation and oversight, including coordination with C3PAOs.
• Extensive experience maintaining evidence repositories to ensure accurate, verifiable evidence is collected for self-attestations or assessments.
• Extensive experience with System Security Plans (SSP), Operational Plans of Action, and Plan of Action & Milestones (POA&M) management, including creating and maintaining required artifacts.
• Strong knowledge of continuous monitoring and risk management/assessment practices, including conducting mock audits to ensure effectiveness and compliance of controls.
• Evaluate, develop, and revise system security documentation, cybersecurity policies, and operational procedures, ensuring alignment with cybersecurity standards and producing audit-ready documentation for the inspection process.
• Extensive experience with Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) data protection requirements.
• Ability to obtain and maintain Special Access Program (SAP) approval within a reasonable period of time, as determined by the company to meet its business needs.
• Possess understanding and working knowledge of the National Industrial Security Program Operating Manual (NISPOM) and Defense Federal Acquisition Regulation Supplement (DFARS)
• Excellent analytical, problem-solving, and communication skills.
• Ability to work independently and as part of a team, effectively delivering on day-to-day objectives.
• Must be able to adapt to a fast-paced and challenging work environment and must demonstrate exceptional interpersonal and leadership skills.
• Demonstrated positive working relationships with internal and external customers.
• Ability to work independently and follow projects through to completion.
• Ability to remain flexible to meet changing priorities and deadlines.

• Develop and maintain information security policies, standards and procedures required for CMMC/NIST compliance: track and manage CMMC security posture compliant with applicable standards, oversee the implementation and maintenance of CMMC/NIST security controls in collaboration with ISSM/ISSO.
• Conduct regular risk assessments and gap analyses to identify vulnerabilities, threats and potential impacts on information systems.
• Assist in the development and active management of the Plan of Action and Milestones (POA&Ms) to address identified information security gaps, tracking progress and ensuring compliant remediation of security issues.
• Develop and implement Cybersecurity risk management strategies; Maintain and periodically review Risk Acceptance/Exceptions to mitigate cybersecurity risks in coordination with ISSM/ISSO.
• Liaise with Certified Third-Party Assessment Organization (C3PAO) during external CMMC audits and aid with audit preparation activities.
• Support continuous monitoring programs to detect and respond to security incidents, ensuring timely reporting and resolution of security incidents.
• Promote a culture of information security awareness and compliance within the organization, monitoring security training and awareness programs for employees, contractors, and vendors.
• Provide guidance on the appropriate classification markings for ITAR, EAR, CUI, FCI, and classified data.
• Other duties as assigned.

The above statements are intended to describe the general nature and level of work being performed by employees assigned to this classification. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required of employees assigned to this position. Avantor is proud to be an equal opportunity employer.

The expected pre-tax pay for this position is

Actual pay may differ depending on relevant factors such as prior experience and geographic location.

We are an Equal Employment/Affirmative Action employer and VEVRAA Federal Contractor. We do not discriminate in hiring on the basis of sex, gender identity, sexual orientation, race, color, religious creed, national origin, physical or mental disability, protected Veteran status, or any other characteristic protected by federal, state/province, or local law.

If you need a reasonable accommodation for any part of the employment process, please contact us by email at recruiting@avantorsciences.com and let us know the nature of your request and your contact information. Requests for accommodation will be considered on a case-by-case basis. Please note that only inquiries concerning a request for reasonable accommodation will be responded to from this email address.

For more information about equal employment opportunity protections, please view the Know Your Rights poster.

We will use the personal information that you have submitted to us in order to consider your application for the relevant role.
 

Your privacy is important to us. Please click here for our Privacy Policy which explains the purposes for which we will use your personal information and the ways in which we will handle and retain your information. It also explains the rights you have in relation to your information, and how to contact us with any queries or requests.

By submitting candidates without having been formally assigned on and contracted for a specific job requisition by Avantor, or by failing to comply with the Avantor recruitment process, you forfeit any fee on the submitted candidates, regardless of your usual terms and conditions. Avantor works with a preferred supplier list and will take the initiative to engage with recruitment agencies based on its needs and will not be accepting any form of solicitation.

Avantor offers a comprehensive benefits package including medical, dental, and vision coverage, wellness programs, health savings and flexible spending accounts, a 401(k) plan with company match, and an employee stock purchase program. Employees also receive 11 paid holidays, accrue 18 PTO days annually, are eligible for volunteer time off and 6 weeks of 100% paid parental leave (except in states that offer paid family leave). These benefits may not apply to employees covered by a collective bargaining agreement or those subject to other eligibility rules.