Cybersecurity Engineer

About the Role

As Cybersecurity Engineer, you own the security posture of Nooks' own unclassified environment — hardening it, assessing it against the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 and the Cybersecurity Maturity Model Certification (CMMC), and keeping the evidence that proves it. Our classified infrastructure gets the headlines, but protecting Controlled Unclassified Information (CUI) is equally critical to the mission and to partner trust. This is a hands-on, individual-contributor role reporting to the Cyber Compliance and Policy Manager in IT/Cyber: you run the compliance program and do the technical work behind it, assessing, hardening, and certifying the estate the IT team builds and operates. Your focus is Nooks' own environment, including the customer facing unclassified network deployed at all Nooks facilities.

Ownership is defined, but the program is still being built: controls need tuning, evidence needs automating, and priorities shift as new tools and vendors enter the environment. This is a "player-coach" role — you set the cadence, run the deep-dive self-assessments and internal audits yourself, and step in wherever the unclassified environment's security needs you, translating NIST controls into practical configurations rather than waiting for perfect requirements.

Key Responsibilities

NIST 800-171 Compliance & Governance

• Own the unclassified environment's compliance posture and maintain the System Security Plan (SSP) against NIST SP 800-171 and CMMC Level 2.
• Track findings and vulnerabilities and manage Plans of Action & Milestones (POA&Ms) to drive timely remediation.
• Generate and maintain SPRS scores, identifying gaps ahead of third-party assessment.
• Strictly adhere to Change Management processes and the Change Control Board (CCB), ensuring all infrastructure modifications are thoroughly validated and tested prior to production deployment.

Self-Assessment & Audit Readiness

• Independently plan and execute comprehensive self-assessments of the unclassified network, acting as internal auditor to validate control effectiveness.
• Lead preparation for C3PAO assessments — compile evidence, interview technical staff, and keep the environment audit-ready at all times.
• Document controls clearly for external auditors and translate requirements for non-technical leadership.

Cloud & Hybrid Infrastructure Security

• Secure and monitor both Google Workspace and Microsoft environments (Active Directory, Group Policy), ensuring proper Separation of Duties (SoD) and secure remote access configurations. 
• Ensure Data Loss Prevention (DLP), access controls, and mobile device management (MDM) meet CUI protection requirements.
• Continuously monitor for configuration drift against the CUI baseline.

Vendor & Software Assurance

• Serve as the primary cybersecurity point of contact for evaluating new enterprise software introductions.
• Assess compliance requirements so new tools meet network-specific security standards and organizational policy.
• Evaluate the compliance posture of third-party tools, software and vendors to preserve the chain of trust.

What Success Looks Like in This Role

Within the first year, Nooks' unclassified environment has a current, accurate SSP and a defensible SPRS score, with gaps identified and driven to closure through POA&Ms before any third-party assessment. Self-assessments run on a regular cadence, and the Google Workspace environment is configured and monitored so DLP, access controls, and MDM demonstrably protect CUI. The environment is audit-ready at all times, and when a C3PAO assessment comes, evidence and artifacts are organized and complete. New software and vendors are vetted for compliance before they enter the environment, preserving the chain of trust. Leadership relies on this role as the authoritative source of truth for the unclassified compliance posture.

Cross-Functional Expectations

This role partners closely and collaboratively with Enterprise IT to secure and monitor the Google Workspace and Microsoft environments and with IT/Cyber Operations to remediate findings across the unclassified estate. It serves as the cybersecurity point of contact for teams across Nooks introducing new software, and provides evidence and technical answers to external C3PAO assessors during audits. It executes on the compliance program owned by the Cyber Compliance and Policy Manager and reports posture and risk up through Enterprise Cyber.

The Skillset

Required

• U.S. citizenship (a compliance requirement for accessing CUI/ITAR data).
• 5–8 years in cybersecurity, with at least 3 years focused specifically on NIST SP 800-171 compliance and implementation.
• Demonstrated experience configuring and securing Google Workspace in a regulated environment, including compliance controls across Drive, Gmail, and endpoint management.
• Proven ability to conduct technical self-assessments — comfortable acting as an auditor, testing controls, and gathering evidence without supervision.
• Deep understanding of DFARS 252.204-7012/7019/7020, NIST SP 800-171, and CMMC Level 2 assessment guides.
• Active DoD 8570/8140 IAM Level II or III certification (e.g., CISSP, CISM, CASP+, or CAP).
• Strong ability to explain technical requirements to non-technical leadership and document controls clearly for external auditors.

Preferred

• CMMC Certified Professional (CCP) or Registered Practitioner (RP).
• Google Professional Cloud Security Engineer or Professional Google Workspace Administrator certification.
• Active Secret or Top Secret clearance (a plus; this role focuses on the unclassified environment).
• Experience functioning as a formal security control assessor (SCA) or QSA.
• Familiarity with detection and incident-response tooling — endpoint detection and response (EDR) and security information and event management (SIEM).

Compensation & Benefits

• Base salary
• Performance bonus
• Equity
• Benefits: Medical, dental, vision, PTO, and 401(k).

Eligibility & Clearance

Candidates must be U.S. citizens (a compliance requirement for accessing CUI/ITAR data) and authorized to work in the United States. This role supports the unclassified environment; an active security clearance is not required, though a Secret or Top Secret clearance is a plus.