Information Technology Project Manager (CMMC)

Georgia Institute of Technology; Seattle (WA); On-site; USD 112,000 - 130,000; Full time

Job summary

Georgia Tech's Office of Information Technology seeks a seasoned program manager with Governance, Risk, and Compliance (GRC) expertise to oversee CMMC-compliant onboarding of researchers and laboratories to the Shield service, and to provide ongoing operational support.

The role requires deep CMMC/NIST SP 800-171 experience, the ability to advise cybersecurity leadership, and the vision to expand Shield across the Georgia Tech research enterprise, including labs and HPC environments.

Qualifications

• Bachelor's degree or equivalent combination of education and experience.
• 10+ years of experience in cybersecurity, governance, risk management, compliance, audit, technology risk, or a related discipline.
• Deep GRC expertise, including controls, risks, testing approaches, evidence standards, control mapping, issue management, risk registers, POA&Ms, policy governance, vendor risk, and continuous monitoring – with a focus on NIST SP 800-171 and CMMC.
• Strong analytical and detail-oriented skills, including precise control wording, accurate requirement mapping, evidence specificity, issue documentation, and comfort working with spreadsheets and large data sets.
• Strong program management instincts, including the ability to define process, structure ambiguity, drive prioritization, track execution, and foster cross-functional collaboration.
• Demonstrated ability to communicate clearly and persuasively with senior leaders, technical teams, auditors, business stakeholders, and institutional partners.

Responsibilities

• Lead project teams through planning and oversight of diverse activities; define project goals, objectives, scope and estimates of schedules, resources and costs involving multiple projects.
• Direct project execution through continual coordination of planning, tasking, performance reporting, change control and issue management.
• Confer with functional users within an assigned business or service area to develop plans to address business needs; develop and implement change management strategies.
• Initiate communications among project teams, customers and appropriate levels of management.
• Deliver project status reports and presentations.
• Develop and manage project budgets.
• Manage acquisition of project related goods and contract services.
• Provide mentoring, training and career guidance for team members.
• Perform other duties as assigned.

Skills

GRC expertise

CMMC experience

NIST SP 800-171

Program management

Regulated environments

Education

Bachelor's Degree or an equivalent combination of education and experience

Job description

Location

Atlanta, GA (In-Person, In-Office)

Job Summary

Georgia Tech's Office of Information Technology (OIT) is seeking a seasoned program manager with Governance, Risk, and Compliance (GRC) expertise to oversee CMMC-compliant onboarding of researchers and laboratories to the Institute's Shield secure research service and operational support to their Shield-based work. Shield supports research activities involving controlled unclassified information (CUI) that Georgia Tech conducts on behalf of the Department of War (DOW) and other U.S. Government sponsors. GT Shield is certified at CMMC Level 2 following a third-party (C3PAO) assessment, meeting all NIST SP 800-171 requirements.

The successful candidate will have the opportunity to shape the expansion of Shield to the Georgia Tech research enterprise, including laboratory environments that conduct cutting-edge research on a broad range of topics.

The successful candidate will bring deep experience with CMMC, NIST SP 800-171, and building, transforming, or materially improving programs operating in complex regulated environments and will be expected to operate as a trusted advisor to cybersecurity leadership and institutional stakeholders.

This position offers a unique opportunity to shape the trajectory of CMMC-compliant research at one of the worlds leading research universities. The role provides broad visibility across the Institute's research enterprise, significant autonomy, and the ability to shape and expand CMMC-compliant research practices at Georgia Tech.

Georgia Tech is a top-ranked public research university situated in the heart of Atlanta, a diverse and vibrant city with significant economic and cultural strengths. The Institute serves more than 45,000 students through top-ranked undergraduate, graduate, and executive programs in engineering, computing, science, business, design, and liberal arts. Georgia Tech's faculty attracted more than $1.4 billion in research awards this past year in fields ranging from biomedical technology to artificial intelligence, energy, sustainability, semiconductors, neuroscience, and national security. Georgia Tech ranks among the nation¿s top 20 universities for research and development spending and No. 1 among institutions without a medical school.

Responsibilities

• Lead project teams through planning, assigning and overseeing diverse activities; define project goals, objectives, scope and estimates of schedules, resources and costs involving multiple projects being conducted simultaneously.
• Direct project execution through continual coordination of planning, tasking, performance reporting, change control and issue management.
• Confer with functional users within an assigned business or service area to develop plans to address business needs; develop and implement change management strategies.
• Initiate communications among project teams, customers and appropriate levels of management.
• Deliver project status reports and presentations.
• Develop and manage project budgets.
• Manage acquisition of project related goods and contract services.
• Provide mentoring, training and career guidance for team members.
• Perform other duties as assigned.

Responsibilities

• Drive and shape the expansion of the Shield research service into the Georgia Tech research enterprise while maintaining CMMC and NIST 800-171 compliance.
• Develop and mature a scalable compliance-assurance framework for laboratories, instrumentation, and research computing environments, including documentation standards, assessment processes, designated local compliance representatives, cybersecurity review workflows, and mechanisms for maintaining ongoing compliance.
• Engage with researchers and translate their requirements into practical and CMMC-compliant solutions that integrate Shield, laboratory, instrumentation, HPC, and other research computing resources to meet their needs.
• Find innovative solutions that enable research across Shield, laboratory, computational, and specialized research environments while maintaining CMMC and NIST SP 800-171 compliance.
• Develop repeatable processes for assessing, integrating, and maintaining the compliance of laboratories, instrumentation, computing resources, and research support services involved in CMMC and CUI research activities. Oversee control framework management, evidence standards, assessment approaches, and issue remediation governance.
• Shape preparations for CMMC third-party (C3PAO) assessments of CMMC compliance in Georgia Tech's laboratory and HPC environments.
• Translate complex cybersecurity, regulatory, and technology risk issues into clear business terms for senior leaders, decision-makers, and non-technical stakeholders.

Educational Requirements

Bachelor's Degree or an equivalent combination of education and experience

Required Qualifications

Bachelor's Degree or an equivalent combination of education and experience

Required Experience

10+ years of progressively responsible experience in cybersecurity, governance, risk management, compliance, audit, technology risk, or a related discipline

Demonstrated deep GRC expertise, including controls, risks, testing approaches, evidence standards, control mapping, issue management, risk registers, POA&Ms, policy governance, vendor risk, and continuous monitoring ¿ with a focus on NIST SP 800-171 and CMMC.

Strong analytical and detail-oriented skills, including precise control wording, accurate requirement mapping, evidence specificity, issue documentation, and comfort working with spreadsheets and large data sets.

Strong program management instincts, including the ability to define process, structure ambiguity, drive prioritization, track execution, and foster cross-functional collaboration.

Demonstrated ability to communicate clearly and persuasively with senior leaders, technical teams, auditors, business stakeholders, and institutional partners.

Ability to think strategically about institutional risk while connecting those risks to practical operational activities, controls, and decisions.

Self-motivated, adaptable, and comfortable operating with a high degree of independence in a complex, decentralized environment.

Preferred Qualifications

Additional Preferred Qualifications

Experience in higher education, academic medical, research, government, consulting, financial services, or similarly complex regulated environments.

Experience developing executive dashboards, risk reporting, control assurance metrics, audit readiness reporting, or compliance maturity reporting.

Experience in decentralized organizations where influence, relationship-building, and stakeholder engagement are essential to program success.

One or more of the following certifications is preferred:

• CISSP
• CISA
• CCP
• CCA
• Other comparable governance, risk, compliance, audit, privacy, cloud security, or cybersecurity certifications

Preferred Educational Qualifications

Advanced degree in cybersecurity, information systems, public policy, law, business administration, risk management, or a related field.

Preferred Experience

10+ years of progressively responsible experience in cybersecurity, governance, risk management, compliance, audit, technology risk, or a related discipline

Demonstrated deep GRC expertise, including controls, risks, testing approaches, evidence standards, control mapping, issue management, risk registers, POA&Ms, policy governance, vendor risk, and continuous monitoring ¿ with a focus on NIST SP 800-171 and CMMC.

Strong analytical and detail-oriented skills, including precise control wording, accurate requirement mapping, evidence specificity, issue documentation, and comfort working with spreadsheets and large data sets.

Strong program management instincts, including the ability to define process, structure ambiguity, drive prioritization, track execution, and foster cross-functional collaboration.

Demonstrated ability to communicate clearly and persuasively with senior leaders, technical teams, auditors, business stakeholders, and institutional partners.

Ability to think strategically about institutional risk while connecting those risks to practical operational activities, controls, and decisions.

Self-motivated, adaptable, and comfortable operating with a high degree of independence in a complex, decentralized environment.

Proposed Salary

Salary Range $112,410 - $130,000 - Depending on experience and preferred skills.

ABILITIES

Strong ability to manage and maintain effective working relationships with a diverse population, perform and effectively, make important decisions under pressure, communicate complex technical subjects to non-technical audiences, and effectively manage/direct team

Knowledge, Skills, & Abilities

Strong ability to manage and maintain effective working relationships with a diverse population, perform and effectively, make important decisions under pressure, communicate complex technical subjects to non-technical audiences, and effectively manage/direct team

KNOWLEDGE

Advanced knowledge in the application of information security concepts, principles and practices; expert knowledge translating legal and regulatory requirements into security controls; strong knowledge designing security controls to meet regulatory compliance requirements, provide training, and lead change and adoption; network security applications, and common internet protocols and applications

SKILLS

This job requires highly seasoned skills in project management, budget administration, written and spoken communications, negotiating, staff supervision and public sector acquisitions. Expert knowledge of technical concepts, capabilities and limitations for a broad range of technologies or solutions is required as is an in-depth understanding of matrix management concepts.

Knowledge, Skills, & Abilities

Georgia Tech is seeking a senior CMMC and NIST SP 800-171 practitioner with program management experience who can independently assess current-state capabilities, design practical future-state processes, influence stakeholders without direct authority, and drive the expansion of Shield more broadly in the Georgia Tech research enterprise.

An exceptional candidate will be able to:

• Build and mature CMMC and NIST 800-171 programs, not merely operate them.
• Evaluate risk and compliance posture across multiple regulatory and control domains in laboratory and HPC settings.
• Design practical, risk-based processes that reduce burden while improving assurance.
• Produce executive-ready recommendations, roadmaps, dashboards, and decision materials.
• Navigate ambiguity, competing priorities, and decentralized decision-making.
• Balance cybersecurity risk management with Georgia Tech's research and innovation missions while maintaining compliance with CMMC and other standards for safeguarding CUI-protected information.

Other Information

This is not a supervisory position.

This position does not have any financial responsibilities.

This position will be required to drive.

This role is not considered a position of trust.

This position does not require a purchasing card (P-Card).

This position will not travel

This position does not require security clearance.

Background Check

Successful candidate must be able to pass a background check. Please visit https://usg.policystat.com/policy/19298143/latest/