Compliance Analyst - CMMC

About the Role

Winsor Consulting Group (WCG) helps Defense Industrial Base (DIB) contractors achieve and maintain CMMC Level 1 and Level 2 compliance, with deep expertise in Microsoft 365 GCC High environments. We're hiring a Compliance Analyst to support our growing CMMC practice -- someone detail-oriented, client-friendly, and eager to build real expertise in defense cybersecurity compliance alongside a senior team. This is a hands-on, execution-focused role. You'll work under the direction of senior consultants to move client engagements forward.

What You'll Do

• Support CMMC Level 1 and Level 2 engagements from gap assessment through certification readiness
• Help interpret and apply CMMC 2.0 and NIST SP 800171 controls to client environments
• Draft and maintain System Security Plans (SSPs), Plans of Action and Milestones (POAMs), and other compliance documentation
• Conduct control mapping and evidence review to flag gaps ahead of C3PAO assessment
• Communicate directly with clients on documentation requests, milestones, and remediation tasks
• Track engagement progress and keep client documentation audit-ready

What You Bring

• At least 2 years of experience in cybersecurity, IT, compliance/GRC, audit, or a related field
• CMMC-specific experience is a plus, not a requirement
• Working familiarity with NIST SP 800171 and CMMC 2.0, or the ability to get up to speed quickly
• Strong written and verbal communication skills, comfortable explaining technical requirements in plain language
• Highly organized, with the discipline to manage documentation and deadlines across multiple clients at once
• Comfortable asking questions and working directly with client stakeholders

Nice to Have

• Exposure to Microsoft 365 GCC High, Azure Government, or similar regulated cloud environments
• CMMC Certified Professional (CCP) or Registered Practitioner (RP) or willingness to pursue
• Security+ (or working toward it)
• Familiarity with DFARS cybersecurity clauses and CUI handling requirements
• Background supporting federal contractors or defense supply chain compliance

What We Offer

• Competitive compensation, based on experience
• Direct mentorship from senior CMMC practitioners
• Real investment in your growth: training, certifications, and a clear path to take on more ownership
• A small, senior team where your work is visible and your questions get answered

Work Environment

Remotely friendly, with availability during core business hours (WCG operates out of Iowa and Arizona) Reliable high-speed internet and a quiet, professional workspace