Pay Range: Commensurate with experience

Benefits Eligible: Yes

Work Schedule: Monday – Friday, 8:00 a.m. to 5:00 p.m. (may include some weekends)

Travel: May be required

Position Introduction:

The University of Oklahoma is building an institutional Controlled Unclassified Information (CUI) program to support its growing portfolio of defense and federally sponsored research, with a goal of CMMC Level 2 certification. We are looking for a hands-on security professional to lead that effort: someone who has implemented NIST SP 800-171 in a real environment, can work shoulder-to-shoulder with IT on technical and administrative controls, and wants to shape how a major research university protects sensitive work while keeping research moving.

Reporting within the Office of the Vice President for Research and Partnerships (OVPRP), you will be the OVPRP’s lead for all CUI matters across OU’s Norman, Health, and Tulsa campuses.

What you will do:

• Lead the development, implementation, and continuous improvement of the university’s path to CMMC Level 2 certification, including readiness assessments, gap remediation and preparation for third-party (C3PAO) assessment.
• Develop, maintain, and oversee required compliance documentation, including the System Security Plan (SSP), Plans of Action and Milestones (POA&M), Security Protection Data submissions, and Supplier Performance Risk System (SPRS) reporting. Partner with OU IT to implement and verify controls for identity and access management, audit logging and monitoring, endpoint protection, incident response, SIEM administration, vulnerability management, and FedRAMP-authorized cloud services.
• Review proposals and awards to identify CUI obligations and decide when projects must operate within the secure research enclave, keeping the boundary as focused as possible.
• Author and maintain policies, procedures, standards, and governance frameworks related to CUI, research security, and compliance with federal regulations.
• Serve as the primary point of contact for principal investigators, research staff, and administrators regarding CUI requirements, secure research environments, and compliance obligations. Coordinate cybersecurity incident reporting and response activities involving covered information systems, including compliance with DFARS 252.204-7012 reporting requirements. Monitor evolving federal requirements, including CMMC, NIST, DoW, and other agency research security requirements, and advise leadership on institutional impacts and compliance strategies.
• Build collaborative relationships across academic, research, and administrative units to ensure compliance efforts support and enable the University's research mission.

What you bring:

• At least five years in information security or research security, including direct implementation of NIST SP 800-171 controls (not only assessment or audit)
• Experience writing or maintaining an SSP and working with IT teams on technical control implementation
• The ability to explain regulatory requirements clearly to researchers, administrators, and executives
• A bachelor’s degree in cybersecurity, information systems, or a related field, or equivalent experience

This is a full-time, exempt position. Occasional travel and some availability outside regular business hours are required.

View full job description

Required Education and Experience:

• Bachelor's degree in cybersecurity, information technology, or a related discipline
• Or 60 months of comparable job experience.
• 5 years of experience in research security, cybersecurity compliance, information security or related field

Required Certifications and Licenses:

• Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Cybersecurity Maturity Model Certification (CMMC Assessor)
• Ability to obtain and maintain a security clearance

Department Preferences:

• CMMC Certified Professional (CCP), Certified Assessor (CCA), Registered Practitioner, CISSP, or CISM
• Experience in a higher education or research environment, or in a defense contractor environment preparing for CMMC or DIBCAC assessment

Hiring Contingent Upon a Background Check: Yes