Role description
CyberSecurity: CMMC Lead Consultant (CCA/CCP) — Independent Contractor
DhyatiCMMC Lead Consultant (CCA/CCP) — Independent Contractor
Engagement:
Part-time, ~9 months |
Location:
Remote, with periodic short trips to the UAE (expenses covered) |
Rate:
Competitive hourly, commensurate with credentials |
Start:
Near-term
About the engagement
Dhyati is mobilizing a CMMC Level 2 readiness program for a containerized, cloud-hosted application environment in the Middle East. The program takes the environment from early NIST SP 800-171 maturity to first-pass C3PAO assessment posture: boundary definition, gap assessment against all 110 controls, CUI enclave architecture, hands-on remediation, full documentation suite, and a mock assessment with Go/No-Go recommendation.
You will be the named CMMC authority on the engagement, directing a capable offshore security engineering and GRC team. They build; you make sure what's built will pass.
Responsibilities
- Serve as the named CMMC authority for the engagement, representing your credentials and past performance as key personnel
- Own the CMMC technical strategy: assessment boundary definition, CUI data-flow scoping decisions, and control-inheritance approach for the sovereign cloud platform
- Lead the gap assessment against NIST SP 800-171 (110 controls) and approve the remediation roadmap
- Review and approve the CUI enclave architecture (segmentation, trust zones, identity/access model, logging)
- Direct remediation priorities and adjudicate control-implementation questions raised by the engineering team; define evidence standards and review evidence sufficiency the way an assessor would
- Guide the SSP, POA&M, and policy suite to assessor-ready quality
- Support the mock C3PAO assessment and co-author the Go/No-Go readiness recommendation
- Act as senior client counterpart in phase-gate reviews; attend key onsite milestones in the UAE (kickoff, discovery, remediation verification, mock assessment)
Required qualifications
- Active
CCA (Certified CMMC Assessor)
credential in good standing with the Cyber AB; strong
CCP
candidates with substantial Level 2 delivery experience will be considered - Demonstrated delivery of at least 2 CMMC Level 2 or NIST SP 800-171 readiness engagements end-to-end (scoping through assessment or mock assessment)
- Deep working knowledge of NIST SP 800-171 / 800-171A assessment objectives, CMMC 2.0 scoping guidance, and evidence expectations of C3PAO assessment teams
- At least one referenceable client willing to speak to your CMMC/800-171 work
- Comfortable directing a remote/offshore engineering team and working across time zones (US/India/UAE overlap)
- Able to travel to the UAE (no visa impediments)
Preferred
- Experience with containerized/cloud-native environments (Kubernetes, DevSecOps pipelines) and cloud shared-responsibility/control-inheritance mapping
- Experience with non-US or sovereign cloud platforms, or environments without FedRAMP inheritance
- Prior work as part of, or alongside, a C3PAO assessment team
- RP/RPA registration history or RPO affiliation
Engagement structure
Independent contractor (consulting agreement) with milestone-aligned hours: heavier involvement during boundary definition, gap assessment, and validation phases; steady advisory cadence during remediation. Approximately 8–12 hours/week average, with peaks around phase gates and onsite visits. As a named key-personnel role, we ask for a good-faith commitment through the full program (~9 months). Further engagement details shared with shortlisted candidates under NDA.