Controlled Unclassified Information (CUI) Compliance Manager, Research

University of Oklahoma • Norman, OK

12d

About The Position

The University of Oklahoma is building an institutional Controlled Unclassified Information (CUI) program to support its defense and federally sponsored research portfolio, with the goal of achieving CMMC Level 2 certification. Reporting within the Office of the Vice President for Research and Partnerships (OVPRP), this position leads CUI matters across the Norman, Health, and Tulsa campuses. The role works closely with IT and research communities to implement and verify security controls while supporting the university’s research mission.

The manager leads the university’s path to CMMC Level 2 certification, including readiness assessments, gap remediation, and preparation for third-party assessment. The role oversees compliance documentation and reporting, reviews proposals and awards for CUI obligations, and determines when projects must use the secure research enclave. It also develops CUI and research-security policies and governance, advises leadership on evolving federal requirements, and coordinates cybersecurity incident reporting and response involving covered information systems.

This is a full-time, exempt position. The work schedule is Monday through Friday, 8:00 a.m. to 5:00 p.m.; occasional work outside regular business hours and some weekend availability are required. Occasional travel may be required. The position requires a background check and the ability to obtain and maintain a security clearance.

Requirements

• At least five years of experience in information security or research security, including direct implementation of NIST SP 800-171 controls.
• Experience writing or maintaining a System Security Plan (SSP).
• Experience working with IT teams on technical control implementation.
• Ability to explain regulatory requirements clearly to researchers, administrators, and executives.
• Bachelor’s degree in cybersecurity, information technology, information systems, or a related discipline, or equivalent/comparable experience; the posting specifies 60 months of comparable job experience as an alternative.
• Five years of experience in research security, cybersecurity compliance, information security, or a related field.
• CISSP, CISM, or CMMC Assessor certification.
• Ability to obtain and maintain a security clearance.
• Availability for occasional work outside regular business hours and some weekends; occasional travel may be required.

Nice To Haves

• CMMC Certified Professional (CCP), Certified Assessor (CCA), or Registered Practitioner credential.
• Experience in a higher education or research environment.
• Experience in a defense contractor environment preparing for CMMC or DIBCAC assessment.

Responsibilities

• Lead development, implementation, and continuous improvement of the university’s path to CMMC Level 2 certification, including readiness assessments, gap remediation, and preparation for third-party C3PAO assessment.
• Develop, maintain, and oversee compliance documentation, including the System Security Plan (SSP), Plans of Action and Milestones (POA&M), Security Protection Data submissions, and Supplier Performance Risk System (SPRS) reporting.
• Partner with OU IT to implement and verify controls for identity and access management, audit logging and monitoring, endpoint protection, incident response, SIEM administration, vulnerability management, and FedRAMP-authorized cloud services.
• Review proposals and awards to identify CUI obligations and determine when projects must operate within the secure research enclave, keeping the enclave boundary as focused as possible.
• Author and maintain policies, procedures, standards, and governance frameworks related to CUI, research security, and federal regulatory compliance.
• Serve as the primary point of contact for principal investigators, research staff, and administrators on CUI requirements, secure research environments, and compliance obligations.
• Coordinate cybersecurity incident reporting and response involving covered information systems, including DFARS 252.204-7012 reporting requirements.
• Monitor evolving federal requirements, including CMMC, NIST, DoW, and other agency research-security requirements, and advise leadership on institutional impacts and compliance strategies.
• Build collaborative relationships across academic, research, and administrative units so compliance efforts support the university’s research mission.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior