Controlled Unclassified Information (CUI) Compliance Manager, Research

University of Oklahoma•Norman, OK

10d

About The Position

The University of Oklahoma is building an institutional Controlled Unclassified Information (CUI) program to support its defense and federally sponsored research portfolio, with the goal of achieving CMMC Level 2 certification. Reporting within the Office of the Vice President for Research and Partnerships (OVPRP), the position serves as the OVPRP’s lead for CUI matters across OU’s Norman, Health, and Tulsa campuses. The role leads the university’s CMMC Level 2 readiness and certification efforts, working closely with IT and research stakeholders to implement security controls while supporting the research mission. The manager oversees CUI compliance documentation and technical and administrative controls, advises on CUI requirements in proposals and awards, and helps determine when projects need to use the secure research enclave. The role also serves as the primary resource for researchers and administrators, coordinates applicable cybersecurity incident reporting and response, and monitors changing federal requirements. This is a full-time, exempt position with a Monday–Friday schedule of 8:00 a.m. to 5:00 p.m.; occasional travel and some availability outside regular business hours, including some weekends, are required. Hiring is contingent upon a background check.

Requirements

At least five years of experience in information security or research security, including direct implementation of NIST SP 800-171 controls; assessment or audit experience alone is not sufficient.
Experience writing or maintaining a System Security Plan (SSP) and working with IT teams on technical control implementation.
Ability to explain regulatory requirements clearly to researchers, administrators, and executives.
Bachelor’s degree in cybersecurity, information technology, information systems, or a related discipline, or equivalent/comparable experience; the posting also specifies 60 months of comparable job experience as an education alternative.
Five years of experience in research security, cybersecurity compliance, information security, or a related field.
CISSP, CISM, or CMMC Assessor certification.
Ability to obtain and maintain a security clearance.
Occasional travel and some availability outside regular business hours are required.

Nice To Haves

CMMC Certified Professional (CCP), Certified Assessor (CCA), Registered Practitioner, CISSP, or CISM, as listed under department preferences.
Experience in a higher education or research environment, or in a defense contractor environment preparing for CMMC or DIBCAC assessment.

Responsibilities

Lead development, implementation, and continuous improvement of the university’s path to CMMC Level 2 certification, including readiness assessments, gap remediation, and preparation for third-party C3PAO assessment.
Develop, maintain, and oversee compliance documentation, including the System Security Plan (SSP), Plans of Action and Milestones (POA&M), Security Protection Data submissions, and Supplier Performance Risk System (SPRS) reporting.
Partner with OU IT to implement and verify controls for identity and access management, audit logging and monitoring, endpoint protection, incident response, SIEM administration, vulnerability management, and FedRAMP-authorized cloud services.
Review proposals and awards to identify CUI obligations and determine when projects must operate within the secure research enclave, keeping the enclave boundary as focused as possible.
Author and maintain policies, procedures, standards, and governance frameworks related to CUI, research security, and federal regulatory compliance.
Serve as the primary point of contact for principal investigators, research staff, and administrators regarding CUI requirements, secure research environments, and compliance obligations.
Coordinate cybersecurity incident reporting and response involving covered information systems, including compliance with DFARS 252.204-7012 reporting requirements.
Monitor evolving federal requirements, including CMMC, NIST, DoW, and other agency research security requirements, and advise leadership on institutional impacts and compliance strategies.
Build collaborative relationships across academic, research, and administrative units so compliance efforts support the university’s research mission.