GRC Program and CMMC Compliance Lead

PAR Systems is seeking a GRC Program and CMMC Compliance Lead to build and mature our enterprise Governance, Risk & Compliance (GRC) program, with an initial focus on advancing PAR’s CMMC readiness and ongoing compliance.

This is an opportunity to build, not simply maintain. You’ll establish practical frameworks, processes, controls, risk practices, and reporting that strengthen cybersecurity and IT governance across PAR. While CMMC is an important near-term priority, your impact will extend into a broader GRC capability supporting PAR’s enterprise risk program.

You’ll partner with Information Systems, Procurement, business leaders, control owners, and external CMMC advisors to translate complex requirements into practical business expectations. This role requires the judgment to make recommendations, provide credible challenge, coach stakeholders, and validate that requirements are being met—not simply interpret regulations or manage a compliance project.

Success Criteria
Your GRC experience will help you establish a practical, sustainable program with clear ownership, repeatable processes, and meaningful measures of risk and compliance. You’ll conduct focused cybersecurity and IT risk assessments, strengthen governance practices, establish useful reporting, and help leaders understand and respond to risk.

An immediate priority will be strengthening PAR’s CMMC Level 2 readiness. You’ll lead the NIST SP 800-171 self-assessment process, validate that the SSP, POA&M, controls, and supporting evidence accurately reflect the operating environment, and coordinate identified gaps through resolution. You’ll work closely with technical owners responsible for implementation and external advisors who provide specialized CMMC expertise.

Success means making compliance practical for the business. You’ll translate regulatory, contractual, and customer requirements into clear expectations, establish accountability, challenge gaps when needed, and help ensure PAR remains prepared for assessments and ongoing compliance as requirements and the business evolve.

Qualifications – Required

Three or more years of progressive experience in governance, risk, compliance, IT audit, information security, or cybersecurity compliance.
Demonstrated hands-on experience implementing, assessing, or managing NIST SP 800-171 and/or CMMC requirements and self-assessments. Experience limited solely to general awareness or indirect exposure is not sufficient.
Working knowledge of CMMC Level 2, NIST SP 800-171 Rev. 2, NIST SP 800-171A assessment objectives, DFARS 252.204-7012, and applicable CMMC contract requirements.
Experience developing and maintaining a System Security Plan, managing Plan of Action & Milestones, control narratives, system descriptions, asset inventories, data-flow documentation, and assessment evidence.
Working knowledge of CMMC assessment scoping, including CUI and FCI identification, system boundaries, security protection assets, shared services, cloud environments, and external service providers.
Strong documentation and evidence-management skills, with demonstrated ability to maintain current compliance artifacts, track cybersecurity findings, coordinate remediation, and drive POA&M items through validated closure. Strong analytical, organizational, written, verbal, and cross-functional communication skills.
US Person

Qualifications – Preferred

Experience significantly supporting a CMMC Level 2 or DFARS cybersecurity compliance program, including preparation for or participation in a C3PAO, DIBCAC, or comparable NIST-based assessment.
Experience supporting cybersecurity requirements and flow-downs across subcontractors and suppliers, including applicable DFARS compliance obligations.
CCP, CISA, CISSP, CRISC, CCA, or comparable certification or assessment experience.
Knowledge or experience with third party risk management programs and reviews.
Experience supporting organizations in defense, aerospace, nuclear, space, or other highly regulated industries.