Contract role · IT / IS · NH defense-tech startup
Google Workspace CMMC IT contractor for a NH defense startup.
This is a contract, in-house IT and information-security role running a Google Workspace environment toward CMMC Level 2 for a Seacoast New Hampshire defense-technology startup. You will own the Controlled Unclassified Information enclave, keep the ITAR scope clean, and coordinate the outside C3PAO, RPO, and managed providers that carry the assessment. This is the Google-native path, not Microsoft GCC High, so we are looking for the short list of people who run CMMC on Google Workspace on purpose.
Type
Contract
Location
Stratham / Seacoast NH area
Mode
On-site / hybrid
What you would own
The work, named plainly.
Run the Google Workspace CUI enclave
Stand up and maintain the Controlled Unclassified Information enclave inside Google Workspace, including Assured Controls, access boundaries, data-region controls, and the logging that an assessor will follow.
Coordinate the assessors, RPO, and managed providers
Be the single internal point of contact who keeps the Registered Provider Organization, any managed IT or MSSP partners, and the assessor when one is scheduled moving toward CMMC Level 2 on one schedule.
Own the SSP and POA&M coordination
Keep the System Security Plan current and drive the Plan of Action and Milestones to close, mapping each NIST SP 800-171 control to evidence the enclave actually produces.
Manage equipment and endpoints
Provision and harden laptops, mobile devices, and endpoints, enforce multi-factor authentication and full-disk encryption, and keep the device inventory clean enough to defend in an assessment.
Keep the ITAR scope clean
Maintain US-person access controls and data-segregation so technical data stays inside the right boundary, and flag the moments where an architecture decision quietly widens ITAR scope.
What we are looking for
The short list of people who fit this.
Google Workspace admin depth
Real administration experience in the Google Workspace Admin console: organizational units, context-aware access, Assured Controls, Vault, and the data-protection settings a CUI enclave depends on.
CMMC 2.0 and NIST SP 800-171 familiarity
You can read the 110 controls, scope a boundary, and tell the difference between a control that is met, a control on a POA&M, and a control that is theater.
ITAR awareness
You understand US-person access, technical-data handling, and why ITAR is usually the pressure point that pushes a shop toward GCC High, so you can keep the Google path defensible.
Comfort in a lean startup
You move fast, document as you go, and stay agile without bolting on enterprise overhead a startup does not need yet. You are happy being the whole IT function rather than one cog in a large one.
Contract and fractional basis
This is a contract engagement, part-time to start and scaling as the compliance build ramps. You are set up to work on a contract basis and you prefer it that way.
Orientation
Why the Google Workspace path is its own short list.
Most CMMC guidance assumes Microsoft GCC High, so the field defaults there and the supply of people who run CMMC on Google Workspace is genuinely small. That is exactly why this role exists and why we are writing directly to you.
The Google Workspace path to CMMC Level 2 is legitimate and supported through Assured Controls and the FedRAMP authorization Google maintains, and it usually carries a lower licensing and operating cost than GCC High for a startup at our stage.
Scoping a tight CUI enclave is the lever that keeps the work sane. The smaller the boundary that actually touches Controlled Unclassified Information, the smaller the assessment scope, the lower the cost, and the shorter the path to a defensible Level 2.
ITAR is the spot where vendors most often push toward GCC High, because US-person access and technical-data segregation feel safer on a government-community cloud. Holding the Google path means architecting those controls deliberately rather than buying your way out of the question. If you have done that, you are who we are looking for.
Questions before you reach out
The questions a candidate asks first, answered straight.
This is a Google Workspace role, not GCC High.
We run CMMC Level 2 on Google Workspace using Assured Controls on purpose, so the depth we need is Google-native administration rather than Microsoft 365 GCC High experience.
This is a contract role, not a W-2 employee position.
It starts part-time and scales as the compliance build ramps, structured on a contract or fractional basis.
It is on-site and hybrid in the Stratham and Seacoast New Hampshire area.
Endpoint work, enclave changes, and equipment handling need you local, while routine administration and documentation can run remote.
We are building toward CMMC Level 2 against the 110 NIST SP 800-171 requirements.
The Department suspended the mandatory Phase II third-party step on July 13, 2026, and the enclave work does not change: the job is to keep the Google Workspace environment assessment-ready against 800-171, own the evidence each control produces, and coordinate the outside providers who support the build.
No active personnel clearance is required for this role.
You do need to be a US person for ITAR purposes, since you will handle access controls around technical data and the CUI enclave.
ITAR-aware means you understand US-person access rules, technical-data segregation, and why ITAR usually pushes a shop toward GCC High.
You can keep the Google Workspace path defensible by architecting those controls deliberately rather than assuming a government-community cloud is the only safe answer.
An outside C3PAO performs the Level 2 assessment when it is scheduled, and an RPO and managed providers support the build.
You are the internal owner who keeps all of them aligned on one schedule, owns the SSP and POA&M coordination, and makes sure the enclave produces the evidence each control needs.
We are an early-stage Seacoast New Hampshire defense-technology startup building toward CMMC Level 2 so we can take on Controlled Unclassified Information work.
The environment is lean and fast, which is why we want someone who is comfortable being the whole IT function rather than one role inside a large department.
Apply
If this is the work you do, let's talk.
Tell us what you have run on Google Workspace, the CMMC stage you took it to, and how you kept ITAR scope clean. Request a conversation and we respond within 48 hours. If a call is easier, reach out directly.