Controlled Unclassified Information (CUI) Compliance Manager, Research

University of Oklahoma; Norman (OK); On-site; USD 120,000 - 180,000; Full time

Job summary

The University of Oklahoma is building an institutional CUI program to support its defense and federally sponsored research, pursuing CMMC Level 2 certification. We seek a hands-on security leader experienced with NIST SP 800-171 to drive that effort across OU’s Norman, Health, and Tulsa campuses.

You will develop compliance documentation, coordinate with OU IT for controls, and act as the primary liaison to researchers and administrators on CUI requirements and incident response.

Qualifications

• 5+ years in information security with direct implementation of NIST SP 800-171.
• Experience writing or maintaining an SSP and working with IT teams on technical control implementation.
• Ability to explain regulatory requirements clearly to researchers, administrators, and executives.
• Bachelor's degree in cybersecurity, information systems, or a related field, or equivalent experience.
• Willingness to travel and availability outside regular business hours.

Responsibilities

• Lead the development, implementation, and continuous improvement of OU's path to CMMC Level 2 certification, including readiness assessments, gap remediation, and third-party assessment preparation.
• Develop, maintain, and oversee SSP, POA&M, SPRS reporting, and related documentation in collaboration with OU IT.
• Review proposals and awards to identify CUI obligations and determine when projects must operate within the secure research enclave.
• Author and maintain policies, procedures, standards, and governance frameworks related to CUI and compliance.
• Serve as the primary point of contact for PIs, researchers, and administrators regarding CUI requirements, secure research environments, and incident reporting.

Job description

Pay Range:Commensurate with experience

Benefits Eligible: Yes

Work Schedule:Monday – Friday, 8:00 a.m. to 5:00 p.m. (may include some weekends)

Travel:May be required

Position Introduction:

The University of Oklahoma is building an institutional Controlled Unclassified Information (CUI) program to support its growing portfolio of defense and federally sponsored research, with a goal of CMMC Level 2 certification. We are looking for a hands‑on security professional to lead that effort: someone who has implemented NIST SP 800-171 in a real environment, can work shoulder‑to‑shoulder with IT on technical and administrative controls, and wants to shape how a major research university protects sensitive work while keeping research moving.

Reporting within the Office of the Vice President for Research and Partnerships (OVPRP), you will be the OVPRP’s lead for all CUI matters across OU’s Norman, Health, and Tulsa campuses.

What you will do:

• Lead the development, implementation, and continuous improvement of the university’s path to CMMC Level 2 certification, including readiness assessments, gap remediation and preparation for third‑party (C3PAO) assessment.
• Develop, maintain, and oversee required compliance documentation, including the System Security Plan (SSP), Plans of Action and Milestones (POA&M), Security Protection Data submissions, and Supplier Performance Risk System (SPRS) reporting. Partner with OU IT to implement and verify controls for identity and access management, audit logging and monitoring, endpoint protection, incident response, SIEM administration, vulnerability management, and FedRAMP‑authorized cloud services.
• Review proposals and awards to identify CUI obligations and decide when projects must operate within the secure research enclave, keeping the boundary as focused as possible.
• Author and maintain policies, procedures, standards, and governance frameworks related to CUI, research security, and compliance with federal regulations.
• Serve as the primary point of contact for principal investigators, research staff, and administrators regarding CUI requirements, secure research environments, and compliance obligations. Coordinate cybersecurity incident reporting and response activities involving covered information systems, including compliance with DFARS 252.204‑7012 reporting requirements. Monitor evolving federal requirements, including CMMC, NIST, DoW, and other agency research security requirements, and advise leadership on institutional impacts and compliance strategies.
• Build collaborative relationships across academic, research, and administrative units to ensure compliance efforts support and enable the University’s research mission.

What you bring:

• At least five years in information security or research security, including direct implementation of NIST SP 800-171 controls (not only assessment or audit)
• Experience writing or maintaining an SSP and working with IT teams on technical control implementation
• The ability to explain regulatory requirements clearly to researchers, administrators, and executives
• A bachelor’s degree in cybersecurity, information systems, or a related field, or equivalent experience

This is a full‑time, exempt position. Occasional travel and some availability outside regular business hours are required.

Required Education and Experience:

• Bachelor's degree in cybersecurity, information technology, or a related discipline
• Or 60 months of comparable job experience.
• 5 years of experience in research security, cybersecurity compliance, information security or related field

Required Certifications and Licenses:

• Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Cybersecurity Maturity Model Certification (CMMC Assessor)
• Ability to obtain and maintain a security clearance

Department Preferences:

• CMMC Certified Professional (CCP), Certified Assessor (CCA), Registered Practitioner, CISSP, or CISM
• Experience in a higher education or research environment, or in a defense contractor environment preparing for CMMC or DIBCAC assessment

Hiring Contingent Upon a Background Check: Yes