Summary: The Quality Systems & Compliance Lead is responsible for managing, maintaining, and driving the effective execution of Hendrick Technical Solutions' Quality Management System (QMS) and operational compliance programs, with primary responsibility for ISO 9001:2015 and Cybersecurity Maturity Model Certification (CMMC) Level 2.

This position serves as the primary resource for QMS administration, internal auditing, management review, compliance monitoring, and continuous improvement of the organization's quality systems. The role ensures that documented processes accurately reflect operational practices, applicable requirements are effectively implemented, and objective evidence is maintained to demonstrate compliance. For CMMC Level 2, this position serves as the critical link between Information Technology, cybersecurity governance, and business operations.

The Quality Systems & Compliance Lead works cross-functionally to translate cybersecurity requirements into practical operational controls, employee responsibilities, documented procedures, and sustainable compliance practices throughout the manufacturing environment.

The successful candidate will possess a strong understanding of both quality management systems and cybersecurity compliance requirements, with the ability to interpret standards, assess compliance gaps, coordinate corrective actions, and influence consistent execution across multiple departments.

Essential Duties & Responsibilities:

ISO 9001:2015 Quality Management System

• Manage and maintain the organization's ISO 9001:2015 Quality Management System, ensuring continued conformity with applicable requirements.
• Serve as the primary internal resource for interpretation, implementation, and ongoing execution of ISO 9001 requirements.
• Develop, maintain, and improve QMS policies, procedures, process documentation, and supporting records.
• Plan, coordinate, and execute the internal audit program, including audit schedules, audit plans, reporting, findings, and follow-up activities.
• Conduct process-based internal audits to evaluate compliance, process effectiveness, and alignment between documented requirements and actual practices.
• Coordinate external certification, surveillance, and recertification audits, including preparation, scheduling, evidence collection, and corrective action follow-up.
• Coordinate and facilitate Management Review activities, ensuring required inputs, outputs, action items, and supporting records are maintained.
• Monitor QMS performance, process effectiveness, quality objectives, and applicable compliance metrics.
• Track audit findings, nonconformances, corrective actions, and opportunities for improvement through verification of effectiveness and closure.
• Partner with process owners to ensure QMS requirements are effectively integrated into daily operations.
• Support document control, records management, employee training, and organizational awareness of quality system requirements.
• Identify opportunities to simplify, standardize, and strengthen QMS processes while maintaining compliance and operational effectiveness.
• Support organizational readiness for future revisions to applicable ISO standards.

CMMC Level 2 Operational Compliance

• Serve as the primary operational compliance liaison between IT, cybersecurity personnel, department leadership, and manufacturing operations.
• Develop and maintain a working understanding of CMMC Level 2 requirements, applicable NIST SP 800-171 controls, and related contractual cybersecurity obligations.
• Translate applicable cybersecurity requirements into operational procedures, employee responsibilities, physical safeguards, and documented business practices.
• Coordinate implementation and ongoing execution of CMMC requirements within manufacturing, quality, engineering, supply chain, human resources, and other applicable operational functions.
• Partner with IT to understand technical control requirements, identify operational dependencies, and ensure responsibilities are clearly defined.
• Support development, maintenance, and implementation of policies and procedures governing Controlled Unclassified Information (CUI), including access, handling, storage, transmission, physical protection, and destruction.
• Coordinate operational compliance activities involving physical security, visitor management, personnel practices, media protection, employee awareness, and controlled information handling.
• Conduct internal compliance reviews and operational walkthroughs to verify that established cybersecurity procedures are consistently followed.
• Identify operational compliance gaps, document findings, coordinate remediation activities, and monitor corrective actions through closure.
• Support maintenance of the System Security Plan (SSP), Plans of Action and Milestones (POA&Ms), control implementation documentation, and supporting assessment evidence in coordination with IT and designated control owners.
• Assist with preparation for CMMC assessments, including evidence collection, personnel interviews, process demonstrations, and coordination with external assessors.
• Coordinate with IT and operational stakeholders to evaluate the compliance impact of changes to facilities, processes, equipment, information flows, and business practices.
• Support cybersecurity awareness and CUI-handling training for employees whose responsibilities involve controlled information or applicable security controls.
• Monitor ongoing operational compliance and communicate emerging risks, deficiencies, and remediation status to leadership.
• Support maintenance of CMMC compliance following assessment or certification through periodic verification, evidence collection, and continuous monitoring.

Compliance Program Management & Continuous Improvement

• Develop and maintain compliance schedules, audit calendars, action trackers, and reporting tools for ISO 9001 and CMMC Level 2 activities.
• Establish clear accountability for compliance requirements, deliverables, corrective actions, and supporting evidence.
• Monitor changes to applicable standards, regulations, contractual requirements, and assessment expectations.
• Communicate compliance requirements and organizational responsibilities to department leaders and process owners.
• Coordinate cross-functional compliance initiatives and ensure timely completion of assigned actions.
• Develop practical training materials, awareness communications, checklists, and other resources that support consistent compliance execution.
• Identify opportunities to integrate common governance practices, document control methods, risk management activities, and corrective action processes across ISO and CMMC programs.
• Provide regular updates to the Director of Quality & Compliance regarding audit readiness, compliance status, open findings, operational risks, and improvement initiatives.
• Promote a culture in which quality and cybersecurity compliance are embedded into daily operations rather than treated solely as audit preparation activities.

Qualifications:

• Bachelor's degree in Quality Management, Business Administration, Information Systems, Cybersecurity, Engineering, or a related discipline preferred; equivalent relevant experience may be considered.
• Minimum 5 years of experience in quality systems, regulatory compliance, cybersecurity compliance, governance, risk management, or a related field preferred.
• Demonstrated working knowledge of ISO 9001:2015, including QMS administration, internal auditing, corrective action, and management review requirements.
• Working knowledge of CMMC Level 2 and NIST SP 800-171, including security control implementation, assessment expectations, and compliance evidence requirements.
• Experience developing, implementing, auditing, or maintaining documented management systems and compliance programs.
• Ability to interpret technical and regulatory requirements and translate them into practical business and operational processes.
• Experience conducting internal audits, compliance assessments, gap analyses, or process evaluations.
• Understanding of corrective action, risk assessment, process improvement, and compliance monitoring methodologies.
• Familiarity with Controlled Unclassified Information (CUI), applicable DFARS cybersecurity requirements, and information protection practices preferred.
• Experience working collaboratively with IT or cybersecurity teams to implement compliance requirements across nontechnical business functions.
• Experience in defense manufacturing, aerospace, automotive, or other regulated manufacturing environments preferred.
• ISO 9001 Internal Auditor or Lead Auditor training/certification preferred.
• CMMC Certified Professional (CCP), Certified Assessor (CCA), or other relevant cybersecurity compliance credentials are a plus.
• Familiarity with Microsoft 365, SharePoint, document management systems, and compliance tracking tools preferred.
• Strong organizational, analytical, documentation, and project coordination skills.
• Excellent written and verbal communication skills, including the ability to communicate technical compliance requirements to employees at all organizational levels.
• Demonstrated ability to manage competing priorities, coordinate cross-functional activities, and drive accountability without direct supervisory authority.
• Strong attention to detail, sound judgment, and commitment to confidentiality and protection of sensitive information.
• Ability to work independently and maintain effective working relationships across technical, administrative, and manufacturing functions.

Education/Experience:

• Bachelor's degree in Quality Management, Business Administration, Information Systems, Cybersecurity, Engineering, or a related discipline preferred; equivalent relevant experience may be considered.
• Minimum 5 years of experience in quality systems, regulatory compliance, cybersecurity compliance, governance, risk management, or a related field preferred.

Certificates and Licenses:

• CMMC Certified Professional (CCP), Certified Assessor (CCA), or other relevant cybersecurity compliance credentials are a plus.
• Demonstrated working knowledge of ISO 9001:2015, including QMS administration, internal auditing, corrective action, and management review requirements.
• Working knowledge of CMMC Level 2 and NIST SP 800-171, including security control implementation, assessment expectations, and compliance evidence requirements.

This role subject to International Traffic in Arms Regulations (ITAR) requirements and as such, U.S. Citizen, Permanent Resident or U.S. Person Status Required.

Hendrick is an Equal Opportunity employer. Minorities, women, veterans, and individuals with disabilities are encouraged to apply. For more information regarding the EEOC, please visit https://www.eeoc.gov/sites/default/files/2023-06/22-088_EEOC_KnowYourRights6.12ScreenRdr.pdf.