Controlled Unclassified Information (CUI) Compliance Manager, ResearchJob no: 494366
Work type: Administrative Staff
Location: Norman
Categories: Technology/Research
Pay Range: Commensurate with experience
Benefits Eligible: Yes
Work Schedule: Monday - Friday, 8:00 a.m. to 5:00 p.m. (may include some weekends)
Travel: May be required
Position Introduction:Reporting within the Office of the Vice President for Research and Partnerships (OVPRP), you will be the OVPRP's lead for all CUI matters across OU's Norman, Health, and Tulsa campuses.
What you will do:
- Lead the development, implementation, and continuous improvement of the university's path to CMMC Level 2 certification, including readiness assessments, gap remediation and preparation for third-party (C3PAO) assessment.
- Develop, maintain, and oversee required compliance documentation, including the System Security Plan (SSP), Plans of Action and Milestones (POA&M), Security Protection Data submissions, and Supplier Performance Risk System (SPRS) reporting. Partner with OU IT to implement and verify controls for identity and access management, audit logging and monitoring, endpoint protection, incident response, SIEM administration, vulnerability management, and FedRAMP-authorized cloud services.
- Review proposals and awards to identify CUI obligations and decide when projects must operate within the secure research enclave, keeping the boundary as focused as possible.
- Author and maintain policies, procedures, standards, and governance frameworks related to CUI, research security, and compliance with federal regulations.
- Serve as the primary point of contact for principal investigators, research staff, and administrators regarding CUI requirements, secure research environments, and compliance obligations. Coordinate cybersecurity incident reporting and response activities involving covered information systems, including compliance with DFARS 252.204-7012 reporting requirements. Monitor evolving federal requirements, including CMMC, NIST, DoW, and other agency research security requirements, and advise leadership on institutional impacts and compliance strategies.
- Build collaborative relationships across academic, research, and administrative units to ensure compliance efforts support and enable the University's research mission.
What you bring:
- At least five years in information security or research security, including direct implementation of NIST SP 800-171 controls (not only assessment or audit)
- Experience writing or maintaining an SSP and working with IT teams on technical control implementation
- The ability to explain regulatory requirements clearly to researchers, administrators, and executives
- A bachelor's degree in cybersecurity, information systems, or a related field, or equivalent experience
This is a full-time, exempt position. Occasional travel and some availability outside regular business hours are required.
View full job description
Required Education and Experience:- Bachelor's degree in cybersecurity, information technology, or a related discipline
- Or 60 months of comparable job experience.
- 5 years of experience in research security, cybersecurity compliance, information security or related field
Required Certifications and Licenses:- Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Cybersecurity Maturity Model Certification (CMMC Assessor)
- Ability to obtain and maintain a security clearance
Department Preferences:- CMMC Certified Professional (CCP), Certified Assessor (CCA), Registered Practitioner, CISSP, or CISM
- Experience in a higher education or research environment, or in a defense contractor environment preparing for CMMC or DIBCAC assessment
Hiring Contingent Upon a Background Check: Yes
Advertised: 29 Oct 2026 Central Daylight Time
Applications close: 28 Jan 2027 Central Standard Time
Whatsapp Facebook LinkedIn Email App
