Research Cybersecurity Compliance Lead

Overview

Utah State University seeks a Research Cybersecurity Compliance Lead to guide the development and long-term management of a secure research computing environment that complies with federal cybersecurity and export control requirements, including CMMC, NIST 800-171, ITAR, EAR, OFAC, and other applicable regulations.

The Lead will work alongside the university’s selected vendor to stand up a compliant, turn-key environment, gaining deep understanding of its architecture and controls from the beginning. Over time, this role will take on increasing responsibility for managing and improving the environment as more of the work shifts in-house.

The position requires both technical and compliance expertise. The Lead will draw on experience in cybersecurity operations, systems administration, and cloud platforms such as Microsoft Entra /M365, combined with knowledge of identity and access management. In addition, the role will oversee compliance alignment, risk management, and assessment readiness, ensuring that research projects meet regulatory obligations and security standards.

The Lead will manage relationships with external vendors, serve as the primary liaison during C3

PAO and other compliance assessments, and work closely with the Office of Research and other partners across campus to ensure researchers can securely conduct projects involving sensitive data while the institution maintains accountability for compliance.

• Vendor collaboration and transition: Partner with the university’s selected vendor to stand up a compliant secure research environment. Learn the environment’s architecture, configuration, and controls from the beginning, with the goal of gradually assuming more responsibility for day-to-day management and long-term sustainability.
• Program leadership: Serve as the lead point of contact for USU’s research cybersecurity compliance program, ensuring that the secure environment supports requirements such as CMMC, NIST 800-171, ITAR, EAR, OFAC, and related regulations.
• Policy and procedure development: Translate cybersecurity and export control requirements into practical research-wide policies, procedures, and standards that can be consistently followed by researchers and IT staff.
• Research collaboration: Work closely with the Office of Research and individual researchers to develop project-specific compliance plans, including Technology Control Plans (TCPs), and provide guidance for securely handling Controlled Unclassified Information (CUI) and other regulated data.
• Assessment readiness: Act as the primary liaison during third-party assessments, including C3
  
  PAO evaluations, ensuring that required documentation and evidence meet CMMC criteria for sufficiency and adequacy and are maintained in an audit-ready state.
• Risk and vulnerability management: Conduct or coordinate internal risk assessments, track vulnerabilities, and ensure remediation within the research environment.
• Documentation stewardship: Maintain essential records, including the System Security Plan (SSP), Plans of Action and Milestones (POA&Ms), incident response procedures, and other compliance documentation.
• Continuous improvement: Regularly evaluate the effectiveness of controls, policies, and processes, providing reports and recommendations to university leadership.
• Training and outreach: Provide guidance and education to researchers and staff on compliance obligations, secure workflows, and the use of the secure research environment.

Minimum Qualifications:

• Bachelor’s degree in information technology, computer science, cybersecurity, engineering, or a closely related field. Equivalent professional experience may be considered in lieu of a degree.
• At least 5 years of professional experience in cybersecurity, systems administration, or IT infrastructure management, with demonstrated responsibility for secure system design and operations.
• Hands‑on experience administering both Linux and Windows environments, including implementation of security baselines and compliance controls.
• Experience with cloud services and identity platforms such as Microsoft Entra , M365, and Azure, particularly in…