> Markdown version of [/jobs/ext/1469370-virtual-chief-information-security-officer](https://www.wearedevelopers.com/jobs/ext/1469370-virtual-chief-information-security-officer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Virtual Chief Information Security Officer - **Company:** Govcon Inc - **Location:** Chicago, IL, United States (Remote available) - **Experience:** Expert - **Salary:** $140,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Microsoft Azure, Cloud Computing, CompTIA Security+, Cyber Security, Information Technology Consulting, System Configuration, Multi-Factor Authentication, Federal Information Processing Standards (FIPS), Identity and Access Management, Windows PowerShell, Azure Active Directory, Security Information and Event Management, Software Vulnerability Management, Wi-Fi Technology, Data Logging, Scripting, Plan of Action and Milestones - **Published:** July 28, 2026 - **Apply:** https://www.dice.com/job-detail/3754be9d-c732-451d-9e5a-a57ab4db9ba4 ## About the Role * 5+ years in cybersecurity, security consulting, or IT compliance with a strong technical foundation, including client-facing advisory experience serving as the senior security voice for client leadership. * Hands-on experience leading CMMC Level 2 / NIST 800-171 readiness engagements end to end, scoping, control assessment, POA&M management, remediation tracking, and evidence and audit documentation. * Strong hands-on command of the security stack, identity and access management (Microsoft Entra ID / Azure AD, MFA, conditional access), endpoint protection (EDR/MDR), network and firewall controls, SIEM/log management, vulnerability management, and email security. * Working knowledge of Microsoft 365 and Azure security, including government cloud (GCC / GCC High), FIPS-validated encryption, and CUI protection as they apply to DFARS and NIST 800-171. * Ability to read and evaluate system configurations and technically validate that controls are implemented and effective, not just documented on paper. * Ability to translate technical risk into business-level guidance for client executives and working knowledge of risk management within a managed-services delivery model. * Background in IT consulting, managed services (MSP), cybersecurity, or compliance advisory services. * Experience supporting GovCon clients and navigating federal regulatory requirements (CMMC, DFARS, NIST 800-171). * Experience accurately tracking and documenting billable time in a client-facing consulting or managed-services environment. * Strong documentation and communication skills for both technical and executive audiences. Bonus Points for * Technical security certifications such as CompTIA Security+, Microsoft SC-200 / SC-300 / SC-100, or Azure Security Engineer (AZ-500). * CISSP, CISM, or an equivalent senior security certification. * CMMC Registered Practitioner (RP/RPA), CCP, or CCA designation. * Hands-on experience implementing or hardening Microsoft 365 GCC High / Azure Government environments. * Experience working with or for an IT/Managed Service Provider (MSP). * Scripting or automation experience (e.g., PowerShell) for security configuration and validation. * Experience participating in or preparing clients for C3PAO assessments. * Experience building or maturing a security program from the ground up. * Experience supporting sales cycles, including proposal development and compliance-focused client discussions. * Experience contributing to go-to-market strategy, service standardization, and cross-functional enablement, including developing repeatable messaging, playbooks, and training for security and compliance programs. Required language skills * Ability to communicate professionally, in English, both written and orally * Ability to write business correspondence and process procedures * Ability to effectively present information and respond to questions from groups of managers, clients, and the general public ## Description As a vCISO, you will serve as a fractional security leader and trusted advisor to Ntiva's GovCon clients, owning the direction of their security program while staying close enough to the work to move it forward. You will lead security and compliance strategy for both prospective and existing clients across the defense industrial base regulatory landscape (CMMC, NIST 800-171/172, DFARS, and the frameworks around them), translate those requirements into practical, prioritized roadmaps, and provide the ongoing assurance clients need to stay defensible over time - not just at a point-in-time assessment. You will support new-business pursuits, strengthen and expand current relationships, and work closely with Sales, Account Management, Engineering, and Delivery teams to align security initiatives with client business objectives. In this role you will help shape Ntiva's go-to-market approach for security and compliance services, mature the GovCon service stack, and ensure a consistent, scalable, and high-quality client experience across delivery, compliance, and advisory. Location and Work Expectations * This is a hybrid role with approximately 10% on-site work at client locations. We are seeking candidates located in either the Chicago or Kansas City areas. The specific allocation of remote versus onsite requirements may fluctuate based on business needs. * Monday-Friday, 8am-5pm CST What you will be doing * Serve as the fractional security leader for a portfolio of GovCon clients, setting security program direction, building and maintaining multi-year security roadmaps, and reporting risk and progress to client leadership in clear business terms. * Lead client risk management: conduct and interpret risk assessments, maintain risk registers, and drive risk-based prioritization of remediation and security investment. * Own ongoing compliance assurance across client programs, continuous control monitoring, periodic reassessment, and evidence maintenance, keeping SPRS scores, SSPs, and POA&Ms current and defensible between formal assessments. * Lead CMMC Level 2 and NIST 800-171 readiness for clients: scope the environment, direct gap assessments, and guide remediation from findings through validated closure. (Ntiva prepares and maintains clients for certification; it is not a C3PAO and does not perform the certifying assessment.) * Technically validate control implementation, review configurations across identity, endpoint, network, cloud (Microsoft 365 / Azure), and logging to confirm NIST 800-171 controls are actually in place and effective, not just documented on paper. * Advise on security architecture and tooling, identity, endpoint, network/firewall, and logging/monitoring, partnering with Engineering and Delivery on designs and controls that make compliance scalable and sustainable. * Provide security leadership during events and incidents: guide client response, oversee containment and remediation, and ensure applicable reporting obligations (e.g., DFARS ) are met. * Develop and maintain client security governance, policies, standards, and procedures aligned to NIST 800-171 and client contractual requirements. * Support Sales and Account Management as the senior security voice in prospective and existing client discussions, including client calls, strategy sessions, and proposal development. * Escalate critical security and compliance risks to GovCon leadership with clear business impact and recommended actions. * Contribute to Ntiva's security and compliance go-to-market strategy and to the standardization, documentation, and maturity of the GovCon service stack., Team members must establish a dedicated safe workspace that is free from distractions, hazards, and that is secure from unauthorized access. This includes following Ntiva's IT User and Security Policies that include but are not limited to password-protecting all equipment, keeping confidential and proprietary documents secure, refraining from using public Wi-Fi, having adequate arrangements in place to avoid significant interruptions from caregiving responsibilities during work hours (except in emergency situations with manager approval). Any remote work away from a team member's normal expected dedicated safe workspace must be requested by team member, is subject to review by management, and must adhere to Ntiva policies and procedures. Our Commitment to a Diverse Workforce At Ntiva, we are committed to creating and maintaining a diverse, inclusive, and welcoming work environment for all employees and job applicants. We firmly believe that a diverse workforce fosters a wider range of perspectives, experiences, and ideas that lead to increased creativity, innovation, and problem-solving capabilities. As an equal opportunity employer, we actively seek to recruit and retain a diverse workforce that reflects the communities we serve. We prohibit discrimination of any kind, including but not limited to race, color, religion, gender, gender identity or expression, sexual orientation, marital status, national origin, age, hair length, protective hairstyles, organ donor status, disability, veteran status, or any other legally protected status and comply with all applicable laws governing nondiscrimination in employment. Application Deadline: The sooner you apply, the sooner we can get to know you! Submit your resume today! Applications will be accepted until 7/31/2026. Equal Opportunity Employer This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Crypto-secure Data Management with In-Database Blockchain](https://www.wearedevelopers.com/videos/632-crypto-secure-data-management-with-in-database-blockchain) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Top Must-Visit Developer Conferences in the US in 2026](https://www.wearedevelopers.com/magazine/679-top-must-visit-developer-conferences-in-the-us-in-2026)