Implementation Specialist, CMMC

About Secureframe Secureframe helps organizations build, automate, and prove trust through modern security, compliance, and risk programs. Our platform helps customers manage evidence, policies, controls, vendors, personnel, assets, and audit readiness across frameworks including SOC 2, ISO 27001, NIST 800-171, and CMMC. We are expanding deeper into the defense industrial base with our CMMC product. For many customers, CMMC is not just a compliance requirement. It is the path to winning or retaining contracts with the Department of Defense, primes, aerospace and defense companies, government agencies, and regulated commercial buyers. Our opportunity is to make CMMC implementation faster, clearer, and more operational for companies that cannot afford to turn a lean team into a full-time compliance department. About the Implementation Team The Implementation team sits within Secureframe's customer organization and works closely with Sales, Customer Success, Product, Engineering, Security, Support, and our partner ecosystem. This team is responsible for helping customers move from signed contract to real operational readiness: scoped environments, configured platform workflows, clear control ownership, evidence collection, remediation tracking, and a credible path to CMMC assessment. This is an early role on a team we are building from scratch. The right person is not only comfortable delivering customer implementations; they want to help define what excellent CMMC implementation looks like at Secureframe. You will create playbooks, improve handoffs, identify repeatable delivery patterns, pressure-test service packaging, and help turn early customer engagements into a scalable implementation motion. About the Role As an Implementation Specialist focused on CMMC, you will lead customer implementations and deliver hands-on technical remediation for defense customers preparing for CMMC Level 2 assessments. You will configure and administer Microsoft 365 GCC High and Azure Government environments, implement and validate security controls, and help customers develop the documentation and evidence needed for assessment readiness. This customer-facing role combines project leadership, Microsoft systems administration, security engineering, and CMMC expertise. You will serve as the primary implementation owner, manage multiple engagements, troubleshoot technical issues, and translate compliance requirements into working configurations and repeatable operating procedures. You will execute technical work within the agreed scope and coordinate with customer IT teams and external partners on shared responsibilities and specialized remediation. What You'll Do Lead end-to-end CMMC implementations from discovery and scoping through environment configuration, control validation, documentation, readiness milestones, and operational handoff. Translate customer requirements into implementation plans with clear scope, timelines, milestones, owners, risks, dependencies, and success criteria; communicate progress and drive accountability across multiple engagements. Translate CMMC Level 2 and applicable NIST SP 800-171 requirements into implementation tasks, identify control gaps, and execute remediation. Help customers operationalize CUI and FCI handling, asset categorization, evidence collection, and assessment preparation. Map where controlled unclassified information (CUI) and federal contract information (FCI) live across email, file sharing, cloud applications, endpoints, engineering systems, specialized equipment, facilities, and third-party providers; document system boundaries and control ownership. Configure Secureframe workflows for control mapping, evidence automation, policies, procedures, owner assignments, remediation tracking, and readiness reporting. Document technical configurations and control evidence, and contribute to System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and assessment preparation. Provision, harden, and administer Microsoft 365 GCC High tenants and Azure Government resources, including virtual machines, storage, Azure Virtual Desktop, backups, and monitoring. Configure Microsoft Entra ID, Conditional Access, multifactor authentication, role-based access, and Privileged Identity Management. Administer Windows Server, Active Directory Domain Services, Group Policy, DNS, and hybrid identity synchronization; configure Microsoft Entra Domain Services where appropriate. Deploy and manage Microsoft Intune for device enrollment, configuration profiles, security baselines, endpoint compliance, encryption, application deployment, and patching. Implement Microsoft Sentinel data connectors, log collection, analytics rules, dashboards, alert tuning, and incident-response automation. Configure Microsoft Defender and Purview for endpoint protection, vulnerability management, data loss prevention, sensitivity labeling, and protection of CUI. Support secure network configurations and coor