Profesional de cumplimiento CMMC
Gestiona el cumplimiento CMMC con el rigor que aplicará un evaluador: objetivos, evidencia, controles heredados y cierre.
Áreas de competencia
- Cyber Resiliency (57)
- Cryptography (39)
- DevSecOps (38)
- Artificial Intelligence (AI) Security (31)
Plantillas de descripción de puesto
Tres borradores listos para editar, pensados para gerentes de contratación y reclutadores: copie uno, reemplace las líneas entre corchetes y publíquelo. Las responsabilidades y los requisitos provienen de los mismos enunciados NICE contra los que se mide este rol.
Los enunciados se muestran en su redacción oficial del marco NICE, que se mantiene en inglés.
Profesional de cumplimiento CMMC: Junior
Buscamos un Profesional de cumplimiento CMMC junior. Trabajará con la guía de colegas senior, se hará cargo de tareas bien delimitadas y crecerá hasta cubrir el rol completo. Gestiona el cumplimiento CMMC con el rigor que aplicará un evaluador: objetivos, evidencia, controles heredados y cierre.
[Empresa] se dedica a [lo que hacen]. La función de seguridad es [tamaño y estructura: p. ej., un equipo de cinco personas que reporta al CTO]. Reemplace este párrafo con el suyo.
Responsabilidades
- Assess the effectiveness of security controls
- Advise senior management on risk levels and security posture
- Advise senior leadership and authorizing official of changes affecting the organization's cybersecurity posture
- Recommend vulnerability remediation strategies
- Determine if cybersecurity inspections, tests, and reviews are coordinated for the network environment
- Determine impact of noncompliance on organizational risk levels
- Determine impact of noncompliance on effectiveness of the enterprise's cybersecurity program
- Establish Security Assessment and Authorization processes
- Trabajar en pareja con colegas senior y crecer mediante retroalimentación estructurada.
- Documentar su trabajo para que el equipo aprenda con usted.
Conocimientos requeridos
- Security Assessment and Authorization (SA&A) processes
- Cybersecurity laws and regulations
- Risk Management Framework (RMF) requirements
- Supply chain risk management principles and practices
- Risk scoring principles and practices
- The four phases of the CMMC Assessment Process (plan and prepare; conduct; report; close out) and the deliverables of each
- Which assessment activities a CCP may perform on a team and which are reserved to a CCA and to the Lead CCA
- The readiness review a C3PAO performs before accepting an organization for assessment and the conditions under which an assessment is stopped
Habilidades
- Creating technical documentation
- Developing security assessments
- Developing policy plans
- Evaluating regulations
- Verifying contractor compliance with contracts
Cómo usar esta plantilla
Copie el borrador, reemplace cada línea entre corchetes, elimine los enunciados que no apliquen a su vacante y agregue rango de compensación y política de ubicación. Las listas de enunciados provienen del marco NICE v2.2.0 del NIST, de modo que los candidatos pueden evaluarse contra los mismos enunciados con Aramis:Insight.
Profesional de cumplimiento CMMC: Nivel medio
Buscamos un Profesional de cumplimiento CMMC. Será responsable de este trabajo en el día a día, colaborará con toda la función de seguridad y elevará el estándar de cómo se hace. Gestiona el cumplimiento CMMC con el rigor que aplicará un evaluador: objetivos, evidencia, controles heredados y cierre.
[Empresa] se dedica a [lo que hacen]. La función de seguridad es [tamaño y estructura: p. ej., un equipo de cinco personas que reporta al CTO]. Reemplace este párrafo con el suyo.
Responsabilidades
- Assess the effectiveness of security controls
- Advise senior management on risk levels and security posture
- Advise senior leadership and authorizing official of changes affecting the organization's cybersecurity posture
- Recommend vulnerability remediation strategies
- Determine if cybersecurity inspections, tests, and reviews are coordinated for the network environment
- Determine impact of noncompliance on organizational risk levels
- Determine impact of noncompliance on effectiveness of the enterprise's cybersecurity program
- Establish Security Assessment and Authorization processes
- Develop computer environment cybersecurity plans and requirements
- Perform security reviews
- Develop a cybersecurity risk management plan
- Recommend risk mitigation strategies
Conocimientos requeridos
- Security Assessment and Authorization (SA&A) processes
- Cybersecurity laws and regulations
- Risk Management Framework (RMF) requirements
- Supply chain risk management principles and practices
- Risk scoring principles and practices
- The four phases of the CMMC Assessment Process (plan and prepare; conduct; report; close out) and the deliverables of each
- Which assessment activities a CCP may perform on a team and which are reserved to a CCA and to the Lead CCA
- The readiness review a C3PAO performs before accepting an organization for assessment and the conditions under which an assessment is stopped
- SPRS: what is posted, by whom, when a score must be current for award, and how an affirmation is recorded
- Conditional CMMC status, the 180-day closeout window, the closeout assessment, and the consequence of missing it
- The CMMC Program's three levels, the assessment type attached to each (self-assessment, C3PAO certification, DIBCAC assessment), and the status and validity period each produces
- The DFARS clauses that carry CMMC and NIST SP 800-171 obligations (252.204-7012, -7019, -7020, -7021) and what each requires of a contractor
Habilidades
- Creating technical documentation
- Developing security assessments
- Developing policy plans
- Evaluating regulations
- Verifying contractor compliance with contracts
- Conducting system reviews
- Assessing security controls
- Performing risk assessments
Cómo usar esta plantilla
Copie el borrador, reemplace cada línea entre corchetes, elimine los enunciados que no apliquen a su vacante y agregue rango de compensación y política de ubicación. Las listas de enunciados provienen del marco NICE v2.2.0 del NIST, de modo que los candidatos pueden evaluarse contra los mismos enunciados con Aramis:Insight.
Profesional de cumplimiento CMMC: Senior
Buscamos un Profesional de cumplimiento CMMC senior. Definirá la dirección de este trabajo, guiará a otros en él y responderá por sus resultados a nivel organizacional. Gestiona el cumplimiento CMMC con el rigor que aplicará un evaluador: objetivos, evidencia, controles heredados y cierre.
[Empresa] se dedica a [lo que hacen]. La función de seguridad es [tamaño y estructura: p. ej., un equipo de cinco personas que reporta al CTO]. Reemplace este párrafo con el suyo.
Responsabilidades
- Assess the effectiveness of security controls
- Advise senior management on risk levels and security posture
- Advise senior leadership and authorizing official of changes affecting the organization's cybersecurity posture
- Recommend vulnerability remediation strategies
- Determine if cybersecurity inspections, tests, and reviews are coordinated for the network environment
- Determine impact of noncompliance on organizational risk levels
- Determine impact of noncompliance on effectiveness of the enterprise's cybersecurity program
- Establish Security Assessment and Authorization processes
- Develop computer environment cybersecurity plans and requirements
- Perform security reviews
- Develop a cybersecurity risk management plan
- Recommend risk mitigation strategies
- Advise on Risk Management Framework process activities and documentation
- Report cybersecurity incidents
- Implement protective or corrective measures when a cybersecurity incident or vulnerability is discovered
- Update security documentation to reflect current application and system security design features
- Guiar a los miembros junior del equipo y revisar su trabajo.
- Representar esta función ante la dirección y ante auditores o clientes.
- Definir estándares, seleccionar herramientas y ser dueño de la hoja de ruta de esta área.
Conocimientos requeridos
- Security Assessment and Authorization (SA&A) processes
- Cybersecurity laws and regulations
- Risk Management Framework (RMF) requirements
- Supply chain risk management principles and practices
- Risk scoring principles and practices
- The four phases of the CMMC Assessment Process (plan and prepare; conduct; report; close out) and the deliverables of each
- Which assessment activities a CCP may perform on a team and which are reserved to a CCA and to the Lead CCA
- The readiness review a C3PAO performs before accepting an organization for assessment and the conditions under which an assessment is stopped
- SPRS: what is posted, by whom, when a score must be current for award, and how an affirmation is recorded
- Conditional CMMC status, the 180-day closeout window, the closeout assessment, and the consequence of missing it
- The CMMC Program's three levels, the assessment type attached to each (self-assessment, C3PAO certification, DIBCAC assessment), and the status and validity period each produces
- The DFARS clauses that carry CMMC and NIST SP 800-171 obligations (252.204-7012, -7019, -7020, -7021) and what each requires of a contractor
- The annual affirmation: who may sign it, when it is due, what the affirming official attests to, and what follows a lapsed or false affirmation
- The CMMC ecosystem's organizations and individual credentials, their authorities, and their limits (Cyber AB, CAICO, C3PAO, RPO, DIBCAC; RP, CCP, CCA, Lead CCA, CCI)
Habilidades
- Creating technical documentation
- Developing security assessments
- Developing policy plans
- Evaluating regulations
- Verifying contractor compliance with contracts
- Conducting system reviews
- Assessing security controls
- Performing risk assessments
- Conducting test events
- Applying security controls
Cómo usar esta plantilla
Copie el borrador, reemplace cada línea entre corchetes, elimine los enunciados que no apliquen a su vacante y agregue rango de compensación y política de ubicación. Las listas de enunciados provienen del marco NICE v2.2.0 del NIST, de modo que los candidatos pueden evaluarse contra los mismos enunciados con Aramis:Insight.
Roles relacionados
Roles que comparten el trabajo o la etapa profesional de este. Cada uno enlaza a sus propios enunciados, preguntas de ejemplo y plantillas de descripción de puesto.