Compliance Analyst/Internal Auditor at NMR Consulting in Huntsville, Alabama

Job description

• We are seeking an Internal Auditor and Compliance Specialist to manage, evaluate, and improve our corporate compliance frameworks. This role leads internal audits of ISO standards, CMMC requirements, CMMI models, and contractual documentation. The position ensures that internal policies, procedures, and evidence align with client contracts, defense requirements, and applicable quality and cybersecurity standards.

Responsibilities

• Compliance Auditing and Assessment
• Framework Auditing: Plan and execute internal audits against CMMC Level 2, NIST800-171 ISO standards such as ISO 9001, ISO 20000, and ISO 27001, and CMMI Development and Services models.
• Gap Analysis: Identify operational, quality, and security gaps relative to current contractual and regulatory obligations.
• Remediation Tracking: Develop, coordinate, and monitor corrective action plans to address audit findings and verify closure.
• Policy and Procedure Management
• Documentation Development: Write, revise, and standardize internal policies, processes, and standard operating procedures.
• Version Control: Maintain the master documentation library and ensure operational teams use approved, current versions.
• Policy Alignment: Map client and contract requirements to corporate policies, controls, and operational workflows.
• Contractual and External Audit Support
• Contract Review: Review contracts to identify regulatory, quality, and cybersecurity requirements.
• External Liaison: Serve as the primary point of contact for external auditors, registrars, and government assessors.
• Evidence Collection: Gather, organize, validate, and present the evidence and artifacts required for certification and formal assessments.
• Quality Management and Organizational Support
• Quality Management Program: Operate, maintain, and continually improve the corporate quality management program and related systems.
• Briefings and Meetings: Prepare and deliver briefings, participate in quality-management meetings, and communicate system status, requirements, risks, and planned actions.
• Training and Adoption: Provide quality- and compliance-related training to headquarters staff so employees understand applicable requirements and follow company policies and procedures. Participate in tabletop exercises to gain knowledge and best practices that can be adopted into our current policies and procedures.
• Strategic Consultation: Research developing standards and regulatory requirements and advise leadership on needed system changes, emerging obligations, and potential competitive differentiators.
• Independent Review: Provide an objective perspective to IT operations in support of cybersecurity compliance, control effectiveness, and related improvement activities.
• Provider Coordination: Coordinate compliance and audit activities with managed service providers.
• Surveillance Audits: Coordinate recurring surveillance and certification audits with corporate staff and external auditors, including annual ISO activities when required.
• Regulatory Awareness: Maintain current knowledge of relevant standards, regulations, contractual requirements, and industry practices.

Requirements

• Education: Bachelor's degree in information technology, cybersecurity, business administration, or a related field.
• Experience: 3-5+ of experience in internal auditing, compliance management, quality assurance, or a closely related function.
• Framework Experience: Demonstrated experience supporting or managing CMMC or NIST SP 800-171, ISO 9001, ISO 20000, or ISO 27001, and CMMI implementations.
• Required Certifications: Security +
• Technical Literacy: Strong understanding of IT systems and processes, cybersecurity controls, data protection requirements, and supply chain risk management.
• Communication: Exceptional technical writing and communication skills, including the ability to translate complex regulations into clear, practical guidance.
• Clearance: The ability to obtain and maintain a U.S. government-issued security clearance is required.
• Collaboration: Strong interpersonal skills and the ability to work effectively with corporate teams, technical personnel, service providers, customers, and external assessors.
• Travel: Ability to travel occasionally based on business and audit requirements.
• Other Responsibilities: Perform other duties as assigned in support of corporate compliance, quality, and operational priorities.

Skills

Required

• Security+
• Cybersecurity controls
• Data protection requirements
• Supply chain risk management
• Strong interpersonal skills

Benefits

• $100,000 - $115,000