Research Information Security & Compliance Manager

Position Number: 004509 Department: Div of Research (Adm) Employment Type: Permanent - Full-time Months Per Year: 12 Essential Duties and Responsibilities The Research Information Security & Compliance Manager reports to the Assistant Vice Chancellor for Research Protections and Integrity in the Division of Research. This position ensures the university's compliance with federal law, state government statutes, university system standards, and UNC Charlotte's internal policies, regulations, procedures, and contractual obligations in the area of information security and privacy. Appropriate frameworks, policies, regulations, guidelines, procedures, and assurance processes are developed for security, privacy, and protection of the university's information assets, including research data. The overall duties are as follows: Works closely with the OneIT Chief Information Security Officer to develop appropriate security strategies to align university security defenses with the evolving threat landscape and changing business requirements. This includes continuous development and improvement of the university's cybersecurity plan and road map. Conduct appropriate gap analyses and develop appropriate procedures, regulations, standards, and rules to ensure compliance. Including but not limited to: UNC Charlotte Data Sensitivity Framework UNC System Security Framework/Baseline based on ISO 27001/2:2013 NIST Cybersecurity Framework and Special Publications series 800 (e.g., 800-53, 800-171) Cybersecurity Maturity Model Certification (CMMC) Framework FISMA (Federal Information Security Management Act of 2002) HIPAA (Health Insurance Portability and Accountability Act of 1996); European GDPR (General Data Protection Regulation) Applicable State and Federal Laws/Regulations Works closely with the Information Security team to perform information security assessments, IT risk assessments, application security reviews, sensitive data security reviews, 3rd party vendor security assessments, information security audit coordination, and information security vendor contract reviews. Partners with university stakeholders to encourage the application of security controls throughout applications and the process development lifecycle. Establish, lead, serve on, or advise the University's committees that address information security, privacy, and compliance issues. Provide leadership on committees that are responsible for establishing and communicating the University-wide information security strategy, governance, policies, and standards. Initiate, facilitate, and promote activities to create information security awareness for the campus community. Provide leadership in the continued development and implementation of the Secure Research Environment (SeRE), both short-term and long-term, to ensure compliance with security requirements such as NIST 800-171 to protect and secure the university's sensitive research data (e.g., CUI ). Work closely with OneIT staff regarding the technical implementation of the frameworks, university policies/regulations/procedures/rules, programs, and processes. Works closely with the Research Security team, the Director of Research Security and COI , Export Control Officer, and Research Data Compliance Coordinator. Works closely with the Division of Research on defense-related initiatives and on research security IT support. Other Responsibilities Supervise and assist temporary staff or graduate assistants as needed. Performs other duties as assigned Minimum Experience / Education Bachelor's degree with two years of related experience, or an equivalent combination of education/experience. Preferred Education Skills and Experience Education & Experience Bachelor's degree in CS, IT, Engineering, or a related technical field. 2+ years in information security, ideally within an academic research environment. CISSP or GIAC certifications preferred; SANS or vendor-specific security certifications are a plus. Technical Skills Proficiency with EDR, IDS/IPS, vulnerability scanners, anti-malware, forensics, and SIEM technology (e.g., Splunk). Practical experience with Cloud (AWS, Azure, GCP), on-premise, and hybrid environments. Expertise in advanced firewalls, encryption, and workstation security. Skilled in security risk assessments, penetration testing, and incident tracking/remediation. Compliance & Governance Strong knowledge of NIST 800-171, NIST 800-53, and CMMC compliance. Familiarity with state government rules and regulations regarding data security. Professional Competencies Proven ability to develop security solutions and provide technical advice to diverse stakeholders (faculty, IT, and administration). Experience implementing cross-functional security solutions in a team environment. Strong technical writing skills for procedural documentation and the ability to present complex info to non-technical audiences. Advanced troubleshooting abilities and a strict commitment to maintaining confidentiality. #J-18808-Ljbffr The University of North Carolina at Charlotte