CMMC Consultant

CMMC Consultant

Part-Time Contract | Remote

About DTCloudOn

DTCloudOn is a Houston-based cybersecurity and managed IT services firm supporting small and mid-sized organizations in the U.S. Defense Industrial Base. We help defense contractors prepare for CMMC Level 2 through readiness planning, Microsoft 365 GCC High migrations, and technical implementation of NIST SP 800-171 controls. We work alongside Cyber AB-registered partners to deliver end-to-end CMMC readiness support.

About the Role

We are seeking a hands-on CMMC implementation professional who has led Microsoft 365 GCC High migrations and performed the technical remediation required to bring defense contractors into compliance with NIST SP 800-171. This is not a purely advisory role. You will work directly in client tenants configuring controls, executing migrations, and closing POA&M items, while also helping us scope and price engagements based on real implementation experience.

This is a flexible, remote, part-time contract role with potential to grow as our client base expands.

What You'll Do

Migration and Implementation

• Lead end-to-end Microsoft 365 GCC High migrations, from tenant provisioning and identity setup through data migration, cutover, and post-migration validation

• Design and build CUI enclaves or full-tenant GCC High environments based on client scope

• Implement NIST SP 800-171 controls across Entra ID, Intune, Purview, Defender, and related Microsoft security tools

• Configure Conditional Access, MFA, device compliance, data loss prevention, sensitivity labeling, audit logging, and encryption to meet CMMC Level 2 requirements

• Remediate gaps identified during assessments and drive POA&M items through to closure

• Produce technical documentation and evidence that supports SSP accuracy and assessment readiness

Assessment, Scoping, and Advisory

• Conduct gap assessments against NIST SP 800-171 and CMMC Level 2 requirements

• Define CUI scope and recommend enclave or full-tenant approaches

• Lead or support discovery and scoping calls with prospective defense contractor clients

• Translate findings into effort estimates, timelines, and fixed-fee pricing grounded in actual implementation effort

• Develop SOWs, proposals, and standardized migration and remediation service packages

• Guide clients on SSP and POA&M development and SPRS scoring

• Strengthen our internal implementation runbooks and estimating methodology

Required Qualifications

• Proven experience leading Microsoft 365 GCC High migrations from planning through cutover

• Hands-on experience implementing and remediating NIST SP 800-171 controls for defense contractors

• Hands-on administration of Entra ID, Conditional Access, Intune, Purview, and Microsoft Defender in GCC or GCC High environments

• Working knowledge of DFARS 252.204-7012, 7019, 7020, and 7021

• Experience with SPRS scoring, SSP development, and POA&M management

• Experience scoping technical projects and writing SOWs or fixed-fee proposals

• Strong communication skills with both executive leadership and technical staff

Preferred Qualifications

• Certified CMMC Professional or Certified CMMC Assessor credential

• Experience supporting organizations through a C3PAO assessment or DIBCAC review

• Familiarity with GCC High migration tools such as BitTitan, ShareGate, AvePoint, or Quest

• Experience with Microsoft Sentinel or other SIEM platforms in government cloud environments

• Security+, CISSP, CISM, or relevant Microsoft certifications such as SC-401, SC-300, MS-102, or MD-102

• Pay Range: $75 – $125 per hour, based on experience