Information Technology Project Manager (CMMC)

Atlanta, GA (In-Person, In-Office)

Georgia Tech's Office of Information Technology (OIT) is seeking a seasoned program manager with Governance, Risk, and Compliance (GRC) expertise to oversee CMMC-compliant onboarding of researchers and laboratories to the Institute's Shield secure research service and operational support to their Shield-based work. Shield supports research activities involving controlled unclassified information (CUI) that Georgia Tech conducts on behalf of the Department of War (DOW) and other U.S. Government sponsors. GT Shield is certified at CMMC Level 2 following a third-party (C3PAO) assessment, meeting all NIST SP 800-171 requirements.

The successful candidate will have the opportunity to shape the expansion of Shield to the Georgia Tech research enterprise, including laboratory environments that conduct cutting-edge research on a broad range of topics.

The successful candidate will bring deep experience with CMMC, NIST SP 800-171, and building, transforming, or materially improving programs operating in complex regulated environments and will be expected to operate as a trusted advisor to cybersecurity leadership and institutional stakeholders.

This position offers a unique opportunity to shape the trajectory of CMMC-compliant research at one of the worlds leading research universities. The role provides broad visibility across the Institute's research enterprise, significant autonomy, and the ability to shape and expand CMMC-compliant research practices at Georgia Tech.

Georgia Tech is a top-ranked public research university situated in the heart of Atlanta, a diverse and vibrant city with significant economic and cultural strengths. The Institute serves more than 45,000 students through top-ranked undergraduate, graduate, and executive programs in engineering, computing, science, business, design, and liberal arts. Georgia Tech's faculty attracted more than $1.4 billion in research awards this past year in fields ranging from biomedical technology to artificial intelligence, energy, sustainability, semiconductors, neuroscience, and national security. Georgia Tech ranks among the nations top 20 universities for research and development spending and No. 1 among institutions without a medical school.

Job Duty 1 -
Lead project teams through planning, assigning and overseeing diverse activities; define project goals, objectives, scope and estimates of schedules, resources and costs involving multiple projects being conducted simultaneously.

Job Duty 2 -
Direct project execution through continual coordination of planning, tasking, performance reporting, change control and issue management.

Job Duty 3 -
Confer with functional users within an assigned business or service area to develop plans to address business needs; develop and implement change management strategies.

Job Duty 4 -
Initiate communications among project teams, customers and appropriate levels of management.

Job Duty 5 -
Deliver project status reports and presentations.

Job Duty 6 -
Develop and manage project budgets.

Job Duty 7 -
Manage acquisition of project related goods and contract services.

Job Duty 8 -
Provide mentoring, training and career guidance for team members.

Job Duty 9 -
Perform other duties as assigned

The CMMC IT Project Manager will:

* Drive and shape the expansion of the Shield research service into the Georgia Tech research enterprise while maintaining CMMC and NIST 800-171 compliance.

* Develop and mature a scalable compliance-assurance framework for laboratories, instrumentation, and research computing environments, including documentation standards, assessment processes, designated local compliance representatives, cybersecurity review workflows, and mechanisms for maintaining ongoing compliance.

* Engage with researchers and translate their requirements into practical and CMMC-compliant solutions that integrate Shield, laboratory, instrumentation, HPC, and other research computing resources to meet their needs.

* Find innovative solutions that enable research across Shield, laboratory, computational, and specialized research environments while maintaining CMMC and NIST SP 800-171 compliance.

* Develop repeatable processes for assessing, integrating, and maintaining the compliance of laboratories, instrumentation, computing resources, and research support services involved in CMMC and CUI research activities. Oversee control framework management, evidence standards, assessment approaches, and issue remediation governance.

* Shape preparations for CMMC third-party (C3PAO) assessments of CMMC compliance in Georgia Tech's laboratory and HPC environments.

* Translate complex cybersecurity, regulatory, and technology risk issues into clear business terms for senior leaders, decision-makers, and non-technical stakeholders.

Educational Requirements
Bachelor's Degree or an equivalent combination of education and experience

Required Experience
10+ years of progressively responsible experience in cybersecurity, governance, risk management, compliance, audit, technology risk, or a related discipline
Demonstrated deep GRC expertise, including controls, risks, testing approaches, evidence standards, control mapping, issue management, risk registers, POA&Ms, policy governance, vendor risk, and continuous monitoring with a focus on NIST SP 800-171 and CMMC.
Strong analytical and detail-oriented skills, including precise control wording, accurate requirement mapping, evidence specificity, issue documentation, and comfort working with spreadsheets and large data sets.
Strong program management instincts, including the ability to define process, structure ambiguity, drive prioritization, track execution, and foster cross-functional collaboration.
Demonstrated ability to communicate clearly and persuasively with senior leaders, technical teams, auditors, business stakeholders, and institutional partners.
Ability to think strategically about institutional risk while connecting those risks to practical operational activities, controls, and decisions.
Self-motivated, adaptable, and comfortable operating with a high degree of independence in a complex, decentralized environment.

Additional Preferred Qualifications
Experience in higher education, academic medical, research, government, consulting, financial services, or similarly complex regulated environments.
Experience developing executive dashboards, risk reporting, control assurance metrics, audit readiness reporting, or compliance maturity reporting.
Experience in decentralized organizations where influence, relationship-building, and stakeholder engagement are essential to program success.
One or more of the following certifications is preferred:
CISSP
CISA
CCP
CCA
Other comparable governance, risk, compliance, audit, privacy, cloud security, or cybersecurity certifications

Preferred Educational Qualifications
Advanced degree in cybersecurity, information systems, public policy, law, business administration, risk management, or a related field.

Preferred Experience
10+ years of progressively responsible experience in cybersecurity, governance, risk management, compliance, audit, technology risk, or a related discipline
Experience in higher education, academic medical, research, government, consulting, financial services, or similarly complex regulated environments.
Experience developing executive dashboards, risk reporting, control assurance metrics, audit readiness reporting, or compliance maturity reporting.
Experience in decentralized organizations where influence, relationship-building, and stakeholder engagement are essential to program success.

Salary Range $112,410 - $130,000 - Depending on experience and preferred skills.

ABILITIES
Strong ability to manage and maintain effective working relationships with a diverse population, perform and effectively, make important decisions under pressure, communicate complex technical subjects to non-technical audiences, and effectively manage/direct team

KNOWLEDGE
Advanced knowledge in the application of information security concepts, principles and practices; expert knowledge translating legal and regulatory requirements into security controls; strong knowledge designing security controls to meet regulatory compliance requirements, provide training, and lead change and adoption; network security applications, and common internet protocols and applications

SKILLS
This job requires highly seasoned skills in project management, budget administration, written and spoken communications, negotiating, staff supervision and public sector acquisitions. Expert knowledge of technical concepts, capabilities and limitations for a broad range of technologies or solutions is required as is an in-depth understanding of matrix management concepts.

Georgia Tech is seeking a senior CMMC and NIST SP 800-171 practitioner with program management experience who can independently assess current-state capabilities, design practical future-state processes, influence stakeholders without direct authority, and drive the expansion of Shield more broadly in the Georgia Tech research enterprise.

An exceptional candidate will be able to:

* Build and mature CMMC and NIST 800-171 programs, not merely operate them.

* Evaluate risk and compliance posture across multiple regulatory and control domains in laboratory and HPC settings.

* Design practical, risk-based processes that reduce burden while improving assurance.

* Produce executive-ready recommendations, roadmaps, dashboards, and decision materials.

* Navigate ambiguity, competing priorities, and decentralized decision-making.

* Balance cybersecurity risk management with Georgia Tech's research and innovation missions while maintaining compliance with CMMC and other standards for safeguarding CUI-protected information.

This is not a supervisory position.
This position does not have any financial responsibilities.
This position will be required to drive.
This role is not considered a position of trust.
This position does not require a purchasing card (P-Card).
This position will not travel
This position does not require security clearance.

Successful candidate must be able to pass a background check. Please visit https://usg.policystat.com/policy/19298143/latest/