Cybersecurity Compliance Manager

U.S. Citizenship Required. Ability to qualify for a US Department of Defense TOP SECRET security clearance required.

This position is in-person.

Toyon is looking for a highly skilled and motivated Cybersecurity Compliance Manager to join our Security team. The ideal candidate will have experience in managing cybersecurity programs in the defense industry and possess strong knowledge of the regulatory requirements of the NIST SP 800-171. The role requires hands-on technical expertise, strong analytical skills, and the ability to work well collaboratively with a team. Applicant will be responsible for security assessment readiness and ongoing compliance with NIST SP 800-171 CMMC requirements across the enterprise. The Cybersecurity Compliance Manager will work with Security and IT teams to ensure that recurring tasks, evidence collection, and reporting obligations in the System Security Plan (SSP) are completed on schedule. This work will involve hands-on configuration of systems, development of security compliance guidelines, and collaboration on system design.

Responsibilities:

• Develop, implement, and maintain the organization’s cybersecurity compliance program
• Provide guidance and direction to the IT Team in relation to cybersecurity topics, encouraging efficient practices
• Implement and validate technical security controls across systems including endpoint protection, firewalls, and audit logging mechanisms
• Conduct regular audits of the organization’s information systems to ensure all information systems meet relevant cybersecurity regulatory requirements
• Conduct host-based and network-based security assessments, including manual and automated vulnerability scanning
• Configure and maintain secure baselines for Linux and Windows systems using tools like Group Policy, Ansible, or similar configuration management platforms
• Participation in the Configuration Management Board
• Perform select technical tasks in Active Directory and Microsoft 365 to support compliance (e.g., account reviews, group policy audits, password/lockout policy checks)
• Write and maintain automation scripts to support compliance monitoring, log aggregation, and remediation workflows
• Perform log correlation and security event analysis using tools like Splunk, Elastic Stack, or similar SIEM solutions
• Assist in the creation of allowable and disallowable lists for enterprise software
• Develop detailed incident response plans in the event of a cybersecurity breach or attack
• Lead technical root cause analysis and remediation of gaps or compliance audit finding
• Support staff awareness and training initiatives to reinforce compliance responsibilities across departments
• Track subcontractor Cybersecurity compliance, and advise management on applicable subcontractor CMMC compliance flow down
• Prepare and maintain detailed documentation, including Security Plans (SSPs), Policies and Procedures, Plans of Action and Milestones (POA&Ms), and other required artifacts