Contract role · IT / IS · NH defense-tech startup
Google Workspace CMMC IT contractor for a NH defense startup.
A contract, in-house IT and information-security role running Google Workspace toward CMMC Level 2 for a Seacoast New Hampshire defense-technology startup. You own the Controlled Unclassified Information enclave, keep the ITAR scope clean, and coordinate the outside C3PAO, RPO, and managed providers. This is the Google-native path, not Microsoft GCC High, so we want the short list of people who run CMMC on Google Workspace on purpose.
Type
Contract
Location
Stratham / Seacoast NH area
Mode
On-site / hybrid
What you would own
The work, named plainly.
Run the Google Workspace CUI enclave
Stand up and maintain the CUI enclave inside Google Workspace: Assured Controls, access boundaries, data-region controls, and the logging an assessor follows.
Coordinate the assessors, RPO, and managed providers
Keep the Registered Provider Organization, any managed IT or MSSP partners, and the assessor, once one is scheduled, moving toward CMMC Level 2 on one schedule.
Own the SSP and POA&M coordination
Keep the System Security Plan current and drive the Plan of Action and Milestones to close, mapping each NIST SP 800-171 control to evidence the enclave produces.
Manage equipment and endpoints
Provision and harden laptops, mobile devices, and endpoints, enforce multi-factor authentication and full-disk encryption, and keep the device inventory assessment-ready.
Keep the ITAR scope clean
Maintain US-person access controls and data segregation so technical data stays inside the boundary, and flag when an architecture decision quietly widens ITAR scope.
What we are looking for
The short list of people who fit this.
Google Workspace admin depth
Hands-on Google Workspace Admin console experience: organizational units, context-aware access, Assured Controls, Vault, and the data-protection settings a CUI enclave rides on.
CMMC 2.0 and NIST SP 800-171 familiarity
You can read the 110 controls, scope a boundary, and tell a met control from one on a POA&M from one that is theater.
ITAR awareness
You understand US-person access, technical-data handling, and why ITAR pushes a shop toward GCC High, so you can keep the Google path defensible.
Comfort in a lean startup
You move fast, document as you go, and skip the enterprise overhead a startup does not need yet. You are happy being the whole IT function.
Contract and fractional basis
A contract engagement, part-time to start and scaling as the compliance build ramps. You are set up to work on contract and prefer it that way.
Orientation
Why the Google Workspace path is its own short list.
Most CMMC guidance assumes Microsoft GCC High, so the field defaults there and few people run CMMC on Google Workspace. That is why this role exists and why we are writing to you.
The Google Workspace path to CMMC Level 2 is legitimate, supported by Assured Controls and Google's FedRAMP authorization, and usually cheaper to license and operate than GCC High at our stage.
A tight CUI enclave keeps the work manageable: the smaller the boundary that touches Controlled Unclassified Information, the smaller the assessment, the lower the cost, and the shorter the path to a defensible Level 2.
ITAR is where vendors most often push toward GCC High: US-person access and technical-data segregation feel safer on a government-community cloud. Holding the Google path means architecting those controls deliberately instead of buying your way out. If you have done that, you are who we want.
Questions before you reach out
The questions a candidate asks first, answered straight.
Google Workspace, not GCC High.
We run CMMC Level 2 on Google Workspace with Assured Controls on purpose, so the depth we need is Google-native administration.
A contract role, not a W-2 position.
It starts part-time and scales as the compliance build ramps, on a contract or fractional basis.
On-site and hybrid in the Stratham and Seacoast New Hampshire area.
Endpoint work, enclave changes, and equipment handling need you local; routine administration and documentation run remote.
CMMC Level 2, against the 110 NIST SP 800-171 requirements.
The Department suspended the mandatory Phase II third-party step on July 13, 2026; the enclave work is unchanged: keep the Google Workspace environment assessment-ready against 800-171, own the evidence each control produces, and coordinate the outside providers.
No active personnel clearance is required.
You do need to be a US person for ITAR purposes, since you handle access controls around technical data and the CUI enclave.
You understand US-person access rules, technical-data segregation, and why ITAR usually pushes a shop toward GCC High, and you keep the Google Workspace path defensible by architecting those controls deliberately.
An outside C3PAO performs the Level 2 assessment once scheduled; an RPO and managed providers support the build.
You keep them on one schedule, own the SSP and POA&M coordination, and make sure the enclave produces the evidence each control needs.
An early-stage Seacoast New Hampshire defense-technology startup building toward CMMC Level 2 to take on Controlled Unclassified Information work.
The environment is lean and fast, so we want someone comfortable being the whole IT function.
Apply
If this is the work you do, let's talk.
Tell us what you have run on Google Workspace, the CMMC stage you took it to, and how you kept ITAR scope clean. We respond within 48 hours.