Cybersecurity Engineer at Nooks

Job description

ABOUT NOOKS Nooks is pioneering Classified-Infrastructure-as-a-Service (CIaaS) — designing, building, and operating Sensitive Compartmented Information Facilities (SCIFs) and other secured, classified environments for the defense and national security community. We work with the agencies, contractors, and mission-driven organizations that keep the nation safe, delivering the physical infrastructure that makes classified work possible. We’re growing fast, operating across multiple markets, and building a company that takes both the mission and the business seriously. About the Role As Cybersecurity Engineer, you own the security posture of Nooks' own unclassified environment — hardening it, assessing it against the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 and the Cybersecurity Maturity Model Certification (CMMC), and keeping the evidence that proves it. Our classified infrastructure gets the headlines, but protecting Controlled Unclassified Information (CUI) is equally critical to the mission and to partner trust. This is a hands-on, individual-contributor role reporting to the Cyber Compliance and Policy Manager in IT/Cyber: you run the compliance program and do the technical work behind it, assessing, hardening, and certifying the estate the IT team builds and operates. Your focus is Nooks' own environment, including the customer facing unclassified network deployed at all Nooks facilities. Ownership is defined, but the program is still being built: controls need tuning, evidence needs automating, and priorities shift as new tools and vendors enter the environment. This is a "player-coach" role — you set the cadence, run the deep-dive self-assessments and internal audits yourself, and step in wherever the unclassified environment's security needs you, translating NIST controls into practical configurations rather than waiting for perfect requirements. Key Responsibilities NIST 800-171 Compliance & Governance Own the unclassified environment's compliance posture and maintain the System Security Plan (SSP) against NIST SP 800-171 and CMMC Level 2. Track findings and vulnerabilities and manage Plans of Action & Milestones (POA&Ms) to drive timely remediation. Generate and maintain SPRS scores, identifying gaps ahead of third-party assessment. Strictly adhere to Change Management processes and the Change Control Board (CCB), ensuring all infrastructure modifications are thoroughly validated and tested prior to production deployment. Self-Assessment & Audit Readiness Independently plan and execute comprehensive self-assessments of the unclassified network, acting as internal auditor to validate control effectiveness. Lead preparation for C3PAO assessments — compile evidence, interview technical staff, and keep the environment audit-ready at all times. Document controls clearly for external auditors and translate requirements for non-technical leadership. Cloud & Hybrid Infrastructure Security Secure and monitor both Google Workspace and Microsoft environments (Active Directory, Group Policy), ensuring proper Separation of Duties (SoD) and secure remote access configurations. Ensure Data Loss Prevention (DLP), access controls, and mobile device management (MDM) meet CUI protection requirements. Continuously monitor for configuration drift against the CUI baseline. Vendor & Software Assurance Serve as the primary cybersecurity point of contact for evaluating new enterprise software introductions. Assess compliance requirements so new tools meet network-specific security standards and organizational policy. Evaluate the compliance posture of third-party tools, software and vendors to preserve the chain of trust. What Success Looks Like in This Role Within the first year, Nooks' unclassified environment has a current, accurate SSP and a defensible SPRS score, with gaps identified and driven to closure through POA&Ms before any third-party assessment. Self-assessments run on a regular cadence, and the Google Workspace environment is configured and monitored so DLP, access controls, and MDM demonstrably protect CUI. The environment is audit-ready at all times, and when a C3PAO assessment comes, evidence and artifacts are organized and complete. New software and vendors are vetted for compliance before they enter the environment, preserving the chain of trust. Leadership relies on this role as the authoritative source of truth for the unclassified compliance posture. Cross-Functional Expectations This role partners closely and collaboratively with Enterprise IT to secure and monitor the Google Workspace and Microsoft environments and with IT/Cyber Operations to remediate findings across the unclassified estate. It serves as the cybersecurity point of contact for teams across Nooks introducing new software, and provides evidence and technical answers to external C3PAO assessors during audits. It executes on the compliance program owned by the Cyber Compliance and Policy Manager and reports posture and risk up through Enterprise Cyber. The Skillset Required U.S. citizenship (a compliance requirement for accessing CUI/ITAR data). 5–8 years in cybersecurity, with at least 3 years focused specifically on NIST SP 800-171 compliance and implementation. Demonstrated experience configuring and securing Google Workspace in a regulated environment, including compliance controls across Drive, Gmail, and endpoint management. Proven ability to conduct technical self-assessments — comfortable acting as an auditor, testing controls, and gathering evidence without supervision. Deep understanding of DFARS 252.204-7012/7019/7020, NIST SP 800-171, and CMMC Level 2 assessment guides. Active DoD 8570/8140 IAM Level II or III certification (e.g., CISSP, CISM, CASP+, or CAP). Strong ability to explain technical requirements to non-technical leadership and document controls clearly for external auditors. Preferred CMMC Certified Professional (CCP) or Registered Practitioner (RP). Google Professional Cloud Security Engineer or Professional Google Workspace Administrator certification. Active Secret or Top Secret clearance (a plus; this role focuses on the unclassified environment). Experience functioning as a formal security control assessor (SCA) or QSA. Familiarity with detection and incident-response tooling — endpoint detection and response (EDR) and security information and event management (SIEM). Compensation & Benefits Base salary Performance bonus Equity Benefits: Medical, dental, vision, PTO, and 401(k). Eligibility & Clearance Candidates must be U.S. citizens (a compliance requirement for accessing CUI/ITAR data) and authorized to work in the United States. This role supports the unclassified environment; an active security clearance is not required, though a Secret or Top Secret clearance is a plus. Salary Range for all departments Salary Range $145,000 — $163,000 USD

Requirements

Must-haves

NIST 800-171 Compliance & Governance
Own the unclassified environment's compliance posture and maintain the System Security Plan (SSP) against NIST SP 800-171 and CMMC Level 2.
Track findings and vulnerabilities and manage Plans of Action & Milestones (POA&Ms) to drive timely remediation.
Generate and maintain SPRS scores, identifying gaps ahead of third-party assessment.
Strictly adhere to Change Management processes and the Change Control Board (CCB), ensuring all infrastructure modifications are thoroughly validated and tested prior to production deployment.
Self-Assessment & Audit Readiness
Independently plan and execute comprehensive self-assessments of the unclassified network, acting as internal auditor to validate control effectiveness.
Lead preparation for C3PAO assessments — compile evidence, interview technical staff, and keep the environment audit-ready at all times.
Document controls clearly for external auditors and translate requirements for non-technical leadership.
Cloud & Hybrid Infrastructure Security
Secure and monitor both Google Workspace and Microsoft environments (Active Directory, Group Policy), ensuring proper Separation of Duties (SoD) and secure remote access configurations.
Ensure Data Loss Prevention (DLP), access controls, and mobile device management (MDM) meet CUI protection requirements.
Continuously monitor for configuration drift against the CUI baseline.
Vendor & Software Assurance
Serve as the primary cybersecurity point of contact for evaluating new enterprise software introductions.
Assess compliance requirements so new tools meet network-specific security standards and organizational policy.

Nice-to-haves

CMMC Certified Professional (CCP) or Registered Practitioner (RP).
Google Professional Cloud Security Engineer or Professional Google Workspace Administrator certification.
Active Secret or Top Secret clearance (a plus; this role focuses on the unclassified environment).
Experience functioning as a formal security control assessor (SCA) or QSA.
Familiarity with detection and incident-response tooling — endpoint detection and response (EDR) and security information and event management (SIEM).
Compensation & Benefits
Performance bonus
Eligibility & Clearance

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: greenhouse
Effort: quick

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Pto