Implementation Specialist, CMMC

About Secureframe

Secureframe helps organizations build, automate, and prove trust through modern security, compliance, and risk programs. Our platform helps customers manage evidence, policies, controls, vendors, personnel, assets, and audit readiness across frameworks including SOC 2, ISO 27001, NIST 800-171, and CMMC.

We are expanding deeper into the defense industrial base with our CMMC product. For many customers, CMMC is not just a compliance requirement. It is the path to winning or retaining contracts with the Department of Defense, primes, aerospace and defense companies, government agencies, and regulated commercial buyers. Our opportunity is to make CMMC implementation faster, clearer, and more operational for companies that cannot afford to turn a lean team into a full-time compliance department.

About the Implementation Team

The Implementation team sits within Secureframe's customer organization and works closely with Sales, Customer Success, Product, Engineering, Security, Support, and our partner ecosystem. This team is responsible for helping customers move from signed contract to real operational readiness: scoped environments, configured platform workflows, clear control ownership, evidence collection, remediation tracking, and a credible path to CMMC assessment.

This is an early role on a team we are building from scratch. The right person is not only comfortable delivering customer implementations; they want to help define what excellent CMMC implementation looks like at Secureframe. You will create playbooks, improve handoffs, identify repeatable delivery patterns, pressure-test service packaging, and help turn early customer engagements into a scalable implementation motion.

About the Role

As an Implementation Specialist focused on CMMC, you will lead customer implementations and deliver hands-on technical remediation for defense customers preparing for CMMC Level 2 assessments. You will configure and administer Microsoft 365 GCC High and Azure Government environments, implement and validate security controls, and help customers develop the documentation and evidence needed for assessment readiness.

This customer-facing role combines project leadership, Microsoft systems administration, security engineering, and CMMC expertise. You will serve as the primary implementation owner, manage multiple engagements, troubleshoot technical issues, and translate compliance requirements into working configurations and repeatable operating procedures. You will execute technical work within the agreed scope and coordinate with customer IT teams and external partners on shared responsibilities and specialized remediation.

What You'll Do

• Lead end-to-end CMMC implementations from discovery and scoping through environment configuration, control validation, documentation, readiness milestones, and operational handoff.

• Translate customer requirements into implementation plans with clear scope, timelines, milestones, owners, risks, dependencies, and success criteria; communicate progress and drive accountability across multiple engagements.

• Translate CMMC Level 2 and applicable NIST SP 800-171 requirements into implementation tasks, identify control gaps, and execute remediation. Help customers operationalize CUI and FCI handling, asset categorization, evidence collection, and assessment preparation.

• Map where controlled unclassified information (CUI) and federal contract information (FCI) live across email, file sharing, cloud applications, endpoints, engineering systems, specialized equipment, facilities, and third-party providers; document system boundaries and control ownership.

• Configure Secureframe workflows for control mapping, evidence automation, policies, procedures, owner assignments, remediation tracking, and readiness reporting. Document technical configurations and control evidence, and contribute to System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and assessment preparation.

• Provision, harden, and administer Microsoft 365 GCC High tenants and Azure Government resources, including virtual machines, storage, Azure Virtual Desktop, backups, and monitoring.

• Configure Microsoft Entra ID, Conditional Access, multifactor authentication, role-based access, and Privileged Identity Management. Administer Windows Server, Active Directory Domain Services, Group Policy, DNS, and hybrid identity synchronization; configure Microsoft Entra Domain Services where appropriate.

• Deploy and manage Microsoft Intune for device enrollment, configuration profiles, security baselines, endpoint compliance, encryption, application deployment, and patching.

• Implement Microsoft Sentinel data connectors, log collection, analytics rules, dashboards, alert tuning, and incident-response automation.

• Configure Microsoft Defender and Purview for endpoint protection, vulnerability management, data loss prevention, sensitivity labeling, and protection of CUI.

• Support secure network configurations and coordinate firewall, VPN, segmentation, and connectivity changes with customer IT teams and partners. Bridge on-premises infrastructure with GCC High, Azure Government, and secure enclaves, including hybrid identity, controlled data flows, access boundaries, and connectivity validation. Account for physical controls and non-Microsoft systems, including Google Workspace, where relevant to customer scope.

• Work with Sales and Customer Success to improve pre-sale scoping, implementation estimates, customer expectation-setting, and handoff quality.

• Provide advisory support on CMMC scope, secure architecture, control gaps, and remediation priorities, translating technical and compliance tradeoffs into practical recommendations for customer stakeholders.

• Collaborate with CMMC partners, MSPs, consultants, auditors, and C3PAOs while maintaining clear boundaries around Secureframe's role in preparation, platform tooling, implementation support, and independent assessment.

• Deliver customer training and technical working sessions that help administrators operate their environments, troubleshoot issues, assign control owners, collect evidence, and maintain readiness. Provide documented procedures and an operational handoff to customer teams and Customer Success.

• Build repeatable implementation assets, including kickoff templates, project plans, RACI models, discovery questionnaires, evidence checklists, status reports, readiness criteria, risk registers, and handoff runbooks.

• Identify patterns across implementations and feed those insights back to Product, Engineering, Sales, Customer Success, and leadership.

• Automate deployment, administration, configuration, and evidence collection using PowerShell, Microsoft Graph, and Azure tooling. Use AI and automation thoughtfully to streamline repeatable delivery work, surface risks, and improve time to value.

What Success Looks Like

• Customers know exactly what they need to do, who owns each workstream, and how Secureframe supports their path to readiness.

• Customers have scoped environments, configured and validated controls, documented procedures, assigned evidence owners, and clear remediation plans. Administrators can operate the implemented environment after handoff.

• Secureframe develops a repeatable CMMC implementation motion that can serve very small businesses, SMBs, mid-market companies, and more complex defense contractors without reinventing the process every time.

• Sales and Customer Success have sharper impl