Compliance Engineer

Duration: 2+ Months

Location: CO-Denver Metro, Hybrid 1-2 days onsite

Overview: Every Turnberry consultant belongs to a practice, an internal group of consultants and leaders with shared experience and expertise. Each of these practices aligns to one of the core services Turnberry offers to clients. As a Compliance Engineer, you will join Turnberry's Digital Modernization practice, where technology and strategy combine to deliver exceptional digital experiences, empowering organizations to thrive in today's digital market.

Responsibilities

• Assess and Scope

• Validate CUI scope: Map where CUI is created, stored, processed and transmitted, including email, file shares, ERP, CAD/CAM workstations, and shop floor systems

• Categorize assets: Classify assets as CUI, Security Protection, Contractor Risk Managed, Specialized (including CNC and OT equipment) or Out-of-Scope, and maintain the asset inventory

• Run the gap assessment: Score current state against the 110 NIST SP 800-171 Rev 2 requirements and the 320 assessment objectives in NIST SP 800-171A, and validate the SPRS score

• Recommend the boundary: Advise on enclave versus enterprise-wide scoping based on the client's CUI and contract terms

• Remediate

• Identity and access: Implement MFA, least privilege, privileged account separation, session lock, and account lifecycle controls across Active Directory and Entra ID

• Endpoint and server hardening: Apply secure baselines (CIS or DISA STIG), FIPS-validated encryption, BitLocker, application control, USB and removable media restrictions, and patch compliance

• Network: Segment CUI and OT networks, configure firewall rules and remote access, and restrict and monitor boundary traffic

• Logging and monitoring: Centralize audit logs, configure SIEM alerting and retention, and establish a review cadence that produces evidence an assessor will accept

• Vulnerability and configuration management: Run authenticated scans, track remediation, and maintain baseline configurations under change control

• Backup and incident response: Validate CUI backup protection and recovery, and build an incident response plan that meets the DFARS 252.204-7012 72-hour reporting requirement

• Document and Prepare

• Write and maintain the System Security Plan (SSP), Plan of Action and Milestones (POA&M), network and data flow diagrams, and supporting policies and procedures

• Build an evidence package organized by assessment objective, with screenshots, configuration exports, logs and records that show each control is implemented and operating

• Lead a mock assessment and prepare client staff for assessor interviews

• Support the Assessment and Close Findings

• Act as the technical point of contact during the C3PAO assessment, demonstrating controls live and answering assessor questions

• Remediate findings and close any POA&M items within the 180-day window allowed for Conditional Level 2 status

• Transfer knowledge to the internal Systems Administrator, including runbooks for the recurring tasks that keep the client compliant through annual affirmations and the three-year recertification

• Inform the AWS GovCloud Roadmap

• Assess current workloads for GovCloud readiness and recommend migration sequencing and approach

• Identify how a GovCloud move affects the CUI boundary, inherited controls and the SSP, so the assessed environment is not invalidated by the migration

• Favor remediation choices that carry forward into GovCloud, avoiding rework after the assessment

• Recommend the skills and team additions the migration will need, with the business justification for each

Qualifications

• 5 or more years of hands-on systems or security engineering in Microsoft-centric environments (Active Directory, Group Policy, Windows Server, Entra ID, Intune, M365)
• Direct, personal implementation of NIST SP 800-171 controls in a Defense Industrial Base organization, plus participation in at least one CMMC Level 2 assessment (C3PAO, DIBCAC or JSVA) or a formal NIST 800-171 audit
• Has authored or substantially written an SSP and POA&M that were reviewed by an assessor
• Working proficiency with Conditional Access, Microsoft Defender for Endpoint, a SIEM (Microsoft Sentinel or equivalent), enterprise firewalls (Fortinet, Palo Alto, SonicWall or similar), VLAN segmentation and vulnerability scanners (Tenable, Qualys, Rapid7 or similar)
• Scripting ability in PowerShell to automate configuration, auditing and evidence collection
• Working knowledge of DFARS 252.204-7012, -7019, -7020 and -7021, and the FedRAMP Moderate equivalency requirement for cloud service providers
• Clear writer and communicator, able to explain controls to a small-business owner and to an assessor
• U.S. person, able to handle CUI and potentially export-controlled (ITAR/EAR) data

Preferred Qualifications

• AWS GovCloud (US) experience, or work in another FedRAMP Moderate or High environment, including IAM, VPC networking, KMS, CloudTrail and AWS Config
• Cyber AB Certified CMMC Professional (CCP) or Certified CMMC Assessor (CCA)
• Security+, CySA+, CISSP or Microsoft SC-series certification (a plus, not a substitute for hands-on experience)
• Experience in manufacturing environments, including CNC machines, legacy OT and shop floor networks that cannot be patched or joined to a domain
• AWS Certified Security Specialty or AWS Solutions Architect, and infrastructure as code experience with Terraform or CloudFormation
• Experience with M365 GCC High or other CUI enclave solutions
• Background in small and mid-sized organizations where one engineer covers many areas

The salary range for this role is $145,000 to $210,000 or the hourly equivalent. Pay is based on several factors including but not limited to education, work experience, certifications, etc. In addition to your salary, Turnberry Solutions offers benefits such as a comprehensive healthcare package (medical, dental, vision), disability and group term life insurance, health and flexible spending accounts, a utilization bonus, 401(k) with match, flexible time off for salaried employees, parental leave for salaried employees, and flexible work arrangements (all benefits are subject to eligibility requirements). No matter where or when you begin a career with Turnberry, you'll find a far-reaching choice of benefits and incentives.

At Turnberry, we are committed to creating a positive and connected work environment for all and are fully invested in and focused on hiring and growing a diverse team of high performers. We believe that uniqueness in ideas, experiences, and backgrounds make us a better Turnberry: Turnberry is an Equal Employment Opportunity employer, and recruits, employs, trains, compensates, and promotes regardless of age, ancestry, family medical or genetic information, gender identity and expression, marital, military, or veteran status; national and ethnic origin; physical or mental disability; political affiliation; pregnancy; race; religion; sex; sexual orientation; and any other protected characteristics. Americans With Disabilities Act (ADA) Turnberry will provide reasonable accommodation with our application process upon request as required to comply with applicable laws. If you have a disability and require accommodation assistance in this application process, please send an email to our Human Resources department at [email protected] .