READVERTISED Security Admin/CMMC Research Analyst (0081494T)

University of Hawaii • Honolulu, HI

11d • Onsite

About The Position

As a member of the University of Hawaiʻi Information Security team, the Security Admin/CMMC Research Analyst oversees, manages, and maintains the university’s information security data protection, risk management, and compliance program, serving as the primary Research Security Compliance Analyst. The role advises on regulatory, legal, and compliance requirements related to CMMC and other international, federal, and state research compliance regulations. It designs, implements, and oversees security frameworks for federally funded research, ensuring university infrastructure and secure research enclaves meet applicable requirements, including CMMC, NIST SP 800-171, NIST SP 800-53, HIPAA, and other federal regulations.

The analyst consults with Principal Investigators during grant pre-award phases, supports development and maintenance of project System Security Plans and Plans of Action and Milestones, maps NIST 800-171 controls to CMMC levels, and helps plan remediation of identified gaps. The position serves as a point of contact for CMMC Third-Party Assessment Organizations and federal auditors; develops and delivers researcher-focused security training and materials; conducts assessments and audits; and reports on compliance and security risks.

The role also supports policy implementation and enforcement, manages university self-assessment and CMMC scores in the Supplier Performance Risk System, monitors regulated technology environments, coordinates incident reporting and response, reviews third-party software and cloud services, and participates in the design and capacity planning of secure research technologies. It collaborates with investigators and university departments, directs student employees, supervises and mentors IT staff, and performs other duties as assigned. The position is temporary, full-time, and 11-month.

Requirements

• A pertinent bachelor’s degree in Computer Sciences, Information Security, or a related field and five years of progressively responsible professional information technology experience involving information security, including two years comparable in scope and complexity to the next lower pay band in the University of Hawaiʻi broadband system; or an equivalent combination of education and professional experience.
• Considerable working knowledge of information security and pertinent standard and evolving information technology concepts, principles, and methodologies.
• Considerable working knowledge of technologies, systems, hardware, and software associated with information security.
• Ability to recognize intricate problems, determine their causes through reasoning and logic, and develop and implement practical, thorough solutions in a timely manner.
• Ability to interpret and implement administrative directives and guidance so IT operations align with organizational standards and industry best practices.
• Ability to communicate information and ideas clearly and accurately in writing and verbally, including through reports and other materials.
• Ability to establish and maintain effective working relationships with internal and external organizations, groups, team leaders, team members, and individuals.
• For supervisory work, demonstrated ability to lead subordinates, manage work priorities and projects, and manage employee relations.
• Ability to translate complex federal rules, regulations, and requirements into actionable steps.
• Ability to apply IT concepts, principles, and methodologies across a range of research projects and environments.
• Considerable working knowledge and experience with NIST 800-171 and NIST 800-53, including SSPs and POAMs.
• Strong understanding of IT service management, cybersecurity principles, risk management, and compliance requirements.
• Experience implementing and maintaining IT best practices, standards, and governance.
• Considerable knowledge of information-security-related standards and of international, federal, state, and local laws and regulations related to information security, privacy, and higher education.
• Considerable working knowledge of current information security technologies and tools.
• Considerable knowledge of establishing or managing a Governance, Risk, and Compliance program for a large, decentralized organization.
• Working knowledge of computer forensics and investigative techniques.
• Experience with systems, systems administration, and network hardware and administration.
• Ability to develop effective training materials and conduct effective in-person training and workshops.
• Ability to combine and apply skill sets from multiple areas of IT.
• Ability to speak, read, comprehend, interpret, and write fluently in English.
• Ability to learn and apply new technologies independently and in a timely manner using books, manuals, online research, and other resources.
• Working knowledge of common Internet protocols, such as TCP/IP, and applications.
• Working knowledge of one or more programming or scripting languages.
• Ability to manage multiple projects.
• Ability to travel out of state.
• Ability to work a variable schedule, including outside normally scheduled hours and day, night, weekend, or holiday hours as directed.

Nice To Haves

• Certifications related to information security, such as CISSP, GIAC/GSEC, or CISM.
• Experience configuring and implementing technical security solutions.
• Ability to supervise student employees.
• Cybersecurity experience in or with higher education.

Responsibilities

• Oversee, manage, and maintain the university’s information security data protection, risk management, and compliance program.
• Serve as the primary Research Security Compliance Analyst and advise on CMMC and other research security compliance requirements.
• Design, implement, and oversee security frameworks for federally funded research, including secure research enclaves.
• Consult with Principal Investigators during grant pre-award phases to interpret security requirements.
• Work with Principal Investigators and others to develop, maintain, and update System Security Plans and Plans of Action and Milestones for research projects.
• Map NIST 800-171 controls to CMMC levels and assist with planning remediation of gaps before certification.
• Serve as a primary contact for CMMC Third-Party Assessment Organizations and federal auditors.
• Educate, advise, and train staff on regulatory compliance and protection of university networks, systems, and data, including proper handling of sensitive research data.
• Develop and maintain online security and compliance education materials tailored to researchers handling Controlled Unclassified Information, including web pages, recordings, learning-management-system materials, and targeted training.
• Assess research environments against NIST SP 800-171, NIST SP 800-53, and other applicable requirements; identify deficiencies and provide risk assessment reports.
• Assist with implementation, dissemination, and enforcement of IT security policies and practices, particularly policies for CUI and Federal Contract Information.
• Manage the accuracy and uploading of university NIST 800-171 self-assessment scores and CMMC scores into the Supplier Performance Risk System.
• Continuously assess and report security risks in university computer systems, networks, and data environments.
• Conduct compliance audits to verify that technical controls, such as MFA, log management, and FIPS-validated encryption, remain operational.
• Coordinate with Principal Investigators, the Information Security Team, and stakeholders to report incidents involving FCI, CUI, and other regulated data to federal agencies within required timelines.
• Implement and maintain processes for reporting security violations to appropriate authorities.
• Participate in architecture, design, and capacity planning for information security products and technologies, Secure Research Enclaves, and CMMC compliance.
• Review third-party software and cloud services intended for regulated research projects.
• Collaborate with departments such as Legal, Internal Audit, HR, treasury, and data governance to direct compliance issues for clarification, guidance, investigation, and resolution.
• Participate in security incident response and investigations, including emergency situations, and provide remediation support.
• Direct student employees working on policies, procedures, assessments, and training.
• Attend regional or national multi-day trainings, meetings, or conferences.
• Follow and implement University of Hawaiʻi System Information Technology Services directives and best-practice guidance, and ensure consistent adoption and enforcement of recommendations.
• Monitor and lead initiatives to enhance system reliability, security, and operational efficiency.
• Supervise and mentor IT staff to ensure administrative directives and industry best practices are understood and followed.
• Perform other duties as assigned.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior