Governance, Risk, and Compliance Manager

Summary

About Powerus

Powerus is building a next-generation American autonomous systems platform designed to move, protect, and sustain critical assets in high-consequence environments. The company combines advanced autonomy, manufacturing capability, operational expertise, and strategic acquisitions to support defense, national security, critical infrastructure, and commercial operations globally.

Mission

Our mission is to deliver resilient autonomous technologies that strengthen national security, improve operational safety, and expand the capabilities of organizations operating in complex environments.

Why Join Powerus

Powerus handles Controlled Unclassified Information (CUI) and export-controlled technical data under Department of Defense contracts. CMMC Level 2 certification is a condition of contract award, and the compliance program must keep pace with the company's growth across engineering and manufacturing.

This role owns that program: the System Security Plan, POA&M, SPRS score, policy set, risk register, and assessment readiness. It works with IT, engineering, legal, contracts, and export compliance.

Position Overview

Powerus is seeking a Governance, Risk, and Compliance (GRC) Manager to build and run the company's compliance program for CUI and export-controlled data, lead the path to CMMC Level 2 certification, and maintain alignment with NIST SP 800-171 and NIST SP 800-53 Rev. 5.

Key Responsibilities

• Own the CMMC Level 2 program, including gap assessments, remediation tracking, and readiness for third-party (C3PAO) assessment
• Write and maintain the System Security Plan (SSP), POA&M, CUI boundary and data-flow documentation, and supporting evidence for all NIST SP 800-171 requirements
• Manage NIST SP 800-171 self-assessments and SPRS score submissions; document compliance with DFARS 252.204-7012, -7019, -7020, and -7021
• Maintain control mappings and crosswalks between NIST SP 800-53 Rev. 5, NIST SP 800-171, and CMMC; support customer and agency assessments that use 800-53-based baselines
• Track NIST SP 800-172 enhanced requirements and advise leadership on applicability
• Run the CUI program: identification, marking, handling, storage, transmission, and destruction, in accordance with the DoD CUI program and NARA guidance
• Work with export compliance and legal to reflect ITAR and EAR controls on technical data in access controls, systems, and procedures
• Maintain the information security policy set, standards, and procedures on a defined review cycle
• Maintain the enterprise risk register, lead risk assessments, track treatment plans, and report risk posture to leadership
• Manage vendor and supply-chain risk, including DFARS and CMMC flow-down to subcontractors and FedRAMP Moderate (or equivalent) verification for cloud service providers
• Own cyber incident reporting procedures, including the 72-hour DoD reporting requirement under DFARS 252.204-7012 and evidence preservation
• Coordinate internal audits, customer security questionnaires, and external assessments
• Run security awareness, CUI handling, and insider-threat training and track completion
• Review security and compliance clauses in solicitations and agreements for contracts and business development

Qualifications

• Must be located in the United States, within commuting distance of Rock Hill, SC
• Bachelor's degree in information security, information systems, or a related discipline, or equivalent practical experience
• Five or more years in GRC, information security compliance, or audit, including three or more years in the U.S. defense industrial base or a government-contracting environment
• Hands-on experience with NIST SP 800-171, CMMC Level 2, and DFARS 252.204-7012, -7019, -7020, and -7021
• Experience implementing or assessing NIST SP 800-53 Rev. 5 controls
• Experience writing and maintaining an SSP and POA&M and performing SPRS self-assessments
• Working knowledge of CUI handling requirements and of ITAR and EAR
• Experience running a policy program, risk register, and third-party risk process
• Experience preparing for or supporting external audits or assessments
• Ability to travel occasionally to company sites, assessments, and supplier reviews
• Ability to obtain and maintain a U.S. Government Secret security clearance
• U.S. citizenship required; this role involves access to ITAR- and EAR-controlled technical data

Preferred Qualifications

• CISSP, CISM, CISA, Certified CMMC Professional (CCP), or Certified CMMC Assessor (CCA)
• Export compliance credentials, such as ECoP
• Experience supporting a successful C3PAO or DIBCAC assessment
• Familiarity with NIST SP 800-172, NIST CSF, ISO 27001, and FedRAMP
• Experience in a manufacturing or hardware environment, including engineering data and OT systems
• Experience with GRC tooling and Google Workspace security controls
• Active U.S. Government Secret security clearance

What We Look For

Candidates should have written or maintained an SSP and POA&M for a defense contractor and be able to describe the assessment it supported and its outcome.

Equal Opportunity Statement

Powerus is an equal opportunity employer committed to building a diverse and mission-driven workforce. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by applicable law.

Job Description

About Powerus

Powerus is building a next-generation American autonomous systems platform designed to move, protect, and sustain critical assets in high-consequence environments. The company combines advanced autonomy, manufacturing capability, operational expertise, and strategic acquisitions to support defense, national security, critical infrastructure, and commercial operations globally.

Mission

Our mission is to deliver resilient autonomous technologies that strengthen national security, improve operational safety, and expand the capabilities of organizations operating in complex environments.

Why Join Powerus

Powerus handles Controlled Unclassified Information (CUI) and export-controlled technical data under Department of Defense contracts. CMMC Level 2 certification is a condition of contract award, and the compliance program must keep pace with the company's growth across engineering and manufacturing.

This role owns that program: the System Security Plan, POA&M, SPRS score, policy set, risk register, and assessment readiness. It works with IT, engineering, legal, contracts, and export compliance.

Position Overview

Powerus is seeking a Governance, Risk, and Compliance (GRC) Manager to build and run the company's compliance program for CUI and export-controlled data, lead the path to CMMC Level 2 certification, and maintain alignment with NIST SP 800-171 and NIST SP 800-53 Rev. 5.

Key Responsibilities

• Own the CMMC Level 2 program, including gap assessments, remediation tracking, and readiness for third-party (C3PAO) assessment
• Write and maintain the System Security Plan (SSP), POA&M, CUI boundary and data-flow documentation, and supporting evidence for all NIST SP 800-171 requirements
• Manage NIST SP 800-171 self-assessments and SPRS score submissions; document compliance with DFARS 252.204-7012, -7019, -7020, and -7021
• Maintain control mappings and crosswalks between NIST SP 800-53 Rev. 5, NIST SP 800-171, and CMMC; support customer and agency assessments that use 800-53-based baselines
• Track NIST SP 800-172 enhanced requirements and advise leadership on applicability
• Run the CUI program: identification, marking, handling, storage, transmission, and destruction, in accordance with the DoD CUI program and NARA guidance
• Work with export compliance and legal to reflect ITAR and EAR controls on technical data in access controls, systems, and procedures
• Maintain the information security policy set, standards, and procedures on a defined review cycle
• Maintain the enterprise risk register, lead risk assessments, track treatment plans, and report risk posture to leadership
• Manage vendor and supply-chain risk, including DFARS and CMMC flow-down to subcontractors and FedRAMP Moderate (or equivalent) verification for cloud service providers
• Own cyber incident reporting procedures, including the 72-hour DoD reporting requirement under DFARS 252.204-7012 and evidence preservation
• Coordinate internal audits, customer security questionnaires, and external assessments
• Run security awareness, CUI handling, and insider-threat training and track completion
• Review security and compliance clauses in solicitations and agreements for contracts and business development

Qualifications

• Must be located in the United States, within commuting distance of Rock Hill, SC
• Bachelor's degree in information security, information systems, or a related discipline, or equivalent practical experience
• Five or more years in GRC, information security compliance, or audit, including three or more years in the U.S. defense industrial base or a government-contracting environment
• Hands-on experience with NIST SP 800-171, CMMC Level 2, and DFARS 252.204-7012, -7019, -7020, and -7021
• Experience implementing or assessing NIST SP 800-53 Rev. 5 controls
• Experience writing and maintaining an SSP and POA&M and performing SPRS self-assessments
• Working knowledge of CUI handling requirements and of ITAR and EAR
• Experience running a policy program, risk register, and third-party risk process
• Experience preparing for or supporting external audits or assessments
• Ability to travel occasionally to company sites, assessments, and supplier reviews
• Ability to obtain and maintain a U.S. Government Secret security clearance
• U.S. citizenship required; this role involves access to ITAR- and EAR-controlled technical data

Preferred Qualifications

• CISSP, CISM, CISA, Certified CMMC Professional (CCP), or Certified CMMC Assessor (CCA)
• Export compliance credentials, such as ECoP
• Experience supporting a successful C3PAO or DIBCAC assessment
• Familiarity with NIST SP 800-172, NIST CSF, ISO 27001, and FedRAMP
• Experience in a manufacturing or hardware environment, including engineering data and OT systems
• Experience with GRC tooling and Google Workspace security controls
• Active U.S. Government Secret security clearance

What We Look For

Candidates should have written or maintained an SSP and POA&M for a defense contractor and be able to describe the assessment it supported and its outcome.

Equal Opportunity Statement

Powerus is an equal opportunity employer committed to building a diverse and mission-driven workforce. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by applicable law.