• Develop, update, and maintain all compliance documentation, including: System Security Plan (SSP), Plan of Actions & Milestones (POA&M), Policies and procedures. • Validate that implemented security controls meet NIST 800-171/CMMC requirements. • Provide expert guidance on compliance strategy, prioritization, and remediation. • Conduct internal risk assessments, gap assessments, and readiness checks. • Ensure continuous compliance and timely updates as regulations evolve. • Monitor firewall alerts, SIEM/log alerts, and system security events. • Review internal logs (server, endpoint, network) on a recurring basis. • Track newly released CVEs and advise on remediation or risk acceptance. • Provide high-level oversight of the organization's security posture. • Coordinate with the IT team regarding control implementation and evidence gathering. • Phase 1 (Build-out): Higher level of involvement establishing controls, documentation, and security architecture. • Phase 2 (Steady State): 5–10 hours/week of ongoing security monitoring, documentation updates, and compliance governance.