Microsoft Cloud Compliance Manager

Edera L3C is a fast-growing healthcare consultancy that addresses today's issues and helps create tomorrow's solutions by connecting the brightest minds in healthcare. Our team of management, technology, and creative services consultants work collaboratively with industry experts who bring deep experience and expertise to create transformational business solutions. We believe complex challenges and multi-faceted opportunities call for multi-disciplinary approaches and that's how we work. We bring industry best practices from the private sector to government and from government to the private sector to transform healthcare. Edera is an L3C (a variation of a limited liability company) that places "purpose before profit;" a social enterprise venture. This means we are focused on a socially beneficial mission to transform organizations rather than being driven to maximize income. Profits beyond our business sustainability goals are reinvested into communities or clients.

We are seeking a Microsoft Cloud Compliance Manager to support the design, implementation, and ongoing operation of compliance programs aligned to FedRAMP and CMMCrequirements. This role focuses on identifying, implementing, and maintaining shared control foundations across both frameworks, with an emphasis on Microsoft-based environments including Azure, Dynamics 365, Power Platform, and Dataverse. The ideal candidate understands how to translate regulatory requirements into practical, auditable controls using Microsoft-native capabilities and inherited cloud controls.

Employment Details

This position offers flexible engagement options and may be structured as a full-time, part-time, contract, or 1099 role depending on candidate availability and project needs. The role is fully remote and carries no supervisory responsibilities. The position reports directly to the Director of Technology.

Compensation will be determined based on experience, employment status, and market analysis.

Responsibilities:

FedRAMP and CMMC Control Alignment:

Lead alignment of organizational security controls to both FedRAMP and CMMC by prioritizing shared requirements across the two frameworks.

Identify common control families including access control, audit logging, configuration management, incident response, risk management, and system integrity.

Support development of a single, harmonized control implementation approach where possible.

Microsoft Cloud Control Implementation:

• Map FedRAMP and CMMC requirements to Microsoft Azure, Dynamics 365, Power Platform, and Dataverse configurations.

• Leverage Microsoft inherited controls and shared responsibility models to reduce implementation burden.

• Validate secure configuration of identity, logging, encryption, and monitoring using Microsoft-native tools.

Policy, Procedure, and Evidence Development:

• Develop and maintain security policies, standards, and procedures aligned to FedRAMP and CMMC expectations.

• Define evidence requirements and support collection of audit-ready artifacts from Microsoft platforms.

• Ensure documentation reflects real system configurations and operational practices.

Risk Management and POA&M Support:

• Support risk assessments, gap analyses, and control maturity evaluations.

• Manage Plan of Action and Milestones (POA&M) development, tracking, and remediation coordination.

• Assist technical teams in translating compliance findings into actionable remediation tasks.

Audit and Assessment Readiness:

• Prepare teams for FedRAMP, CMMC, or third-party assessments by coordinating interviews, walkthroughs, and evidence reviews.

• Serve as a liaison between technical teams, leadership, and assessors.

• Support ongoing continuous monitoring and compliance reporting activities.

Cross-Functional Collaboration:

• Work closely with architects, developers, system administrators, and support analysts to ensure compliance is embedded into system design and operations.

• Provide guidance on secure-by-design and compliance-by-default practices within Microsoft solutions.

• Support training and awareness efforts related to compliance responsibilities.

FedRAMP and CMMC Common Control Focus

• Identity and Access Management (Azure AD, role-based access control, least privilege)

• Audit Logging and Monitoring (centralized logging, retention, alerting)

• Configuration and Change Management

• Incident Response and Reporting

• Risk Management and Continuous Monitoring

• Encryption of data at rest and in transit

• Asset and System Inventory

• Security Awareness and Role-Based Training

Required Knowledge and Skills:

• Bachelor's degree in Information Security, Information Technology, or related field, or equivalent experience.

• Demonstrated experience supporting FedRAMP and/or CMMC compliance efforts.

• Strong understanding of NIST 800-53 and NIST 800-171 control frameworks.

• Experience implementing compliance controls within Microsoft Azure and Microsoft enterprise platforms.

• Familiarity with shared responsibility models and inherited cloud controls.

• Ability to translate regulatory language into practical technical and operational actions.

• Strong documentation, communication, and stakeholder coordination skills.

If you are a compliance professional who understands both regulatory frameworks and Microsoft cloud realities, we encourage you to apply. Join our team and help build sustainable, audit-ready compliance foundations that support secure and scalable healthcare technology solutions.

All applicants must be US citizens and able to obtain a Public Trust clearance. Edera participates in the E-Verify program. Edera is a drug-free workplace.

Edera is an Equal Opportunity and Affirmative Action Employer. Edera prohibits discrimination against individuals based on their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other category protected by law. Edera takes affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identify, national origin, disability, or veteran status.

Desirable (Not Required) Skills/Experience

• PMP or SAFe certification

• Prior military or DHA experience

If you are a technically strong architect with a passion for building clean, secure, and scalable Microsoft integration solutions, we encourage you to apply. Join our team and play a critical role in shaping the interoperability foundation of enterprise Microsoft platforms.

All applicants must be US citizens and able to obtain a Public Trust clearance. Edera participates in the E-Verify program. Edera is a drug-free workplace.

Edera is an Equal Opportunity and Affirmative Action Employer. Edera prohibits discrimination against individuals based on their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other category protected by law. Edera takes affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identify, national origin, disability, or veteran status.