Cybersecurity GRC Team Lead

This is a remote-eligible opportunity offering flexible work arrangements, competitive benefits, and the chance to lead a highly impactful team within the Information Security Office (ISO) at UT Austin. The Cybersecurity Governance, Risk, and Compliance (GRC) Team Lead will oversee a team of analysts responsible for supporting security compliance efforts across a variety of university operations-with a notable focus on controlled research environments and compliance with CUI-related frameworks (e.g., NIST 800-171, DFARS, ITAR, and CMMC).

In addition to supporting controlled research, this role will also guide the team's work in other key compliance areas such as HIPAA, PCI-DSS, NIST 800-53, and internal policy requirements.

This position is central to building a mature, risk-informed, and agile GRC program that aligns with the university's research mission and enterprise IT operations.

You will get to work with a very intelligent and dedicated team to address enterprise cybersecurity challenges through novel approaches in an office that highly values work-life balance, the freedom to explore out of the box ideas, and serving others.

Most importantly, you will help our researchers to securely advance their pursuits. What starts here changes the world!

Your skills will make a difference

You'll be working for a university that is internationally recognized for research and the work you do will make a difference in the lives of our students, faculty and staff. You'll also be working for a team that is nationally respected by their peer community. If you're the type of person that wants to know your work has meaning and impact, you'll like working for our team., The Cybersecurity GRC Team Lead provides strategic and operational leadership for the GRC team in the ISO. This team performs risk assessments, policy development, control evaluations, and compliance support across a range of regulatory and internal frameworks. The Team Lead is expected to be a subject matter expert in multiple areas of compliance, with a strong emphasis on controlled research programs and CUI handling requirements, while also ensuring broad support for the university's evolving GRC needs., * Lead and manage a team of cybersecurity GRC analysts responsible for:

• Supporting the Controlled Research Program and ensuring alignment with CUI-related frameworks (e.g., NIST 800-171, CMMC, DFARS, ITAR)
• Conducting risk assessments, gap analyses, control reviews, and compliance documentation for enterprise-wide regulatory frameworks, such as HIPAA, PCI-DSS, NIST 800-53, GLBA, and others.
• Advising on appropriate security controls, documenting implementation strategies, and helping units align with both external requirements and internal policy.

• Oversee development and maintenance of security compliance documentation including System Security Plans (SSPs), POA&Ms, risk registers, and internal/external audit response materials.
• Work with stakeholders across the institution-including IT leadership, research administration, legal, and compliance offices-to interpret regulatory requirements and provide practical guidance.
• Serve as a liaison between the ISO and external auditors, assessors, and institutional compliance teams.
• Maintain awareness of emerging regulatory requirements (e.g., new CMMC versions, updated HIPAA guidance, changes in PCI-DSS) and proactively update practices and communications.
• Guide and mentor team members, supporting both professional development and technical growth.
• Participate in strategic planning and contribute to the long-term vision of a cohesive, risk-informed GRC program that supports research and administrative operations.
• Ensure continuous improvement of GRC processes, templates, and tools; support GRC platform management (e.g., IsoraGRC).
• Perform other duties as assigned to support the Information Security Office's mission., The retirement plan for this position is Teacher Retirement System of Texas (TRS), subject to the position being at least 20 hours per week and at least 135 days in length., Employees may be required to report violations of law under Title IX and the Jeanne Clery Disclosure of Campus Security Policy and Crime Statistics Act (Clery Act). If this position is identified a Campus Security Authority (Clery Act), you will be notified and provided resources for reporting. Responsible employees under Title IX are defined and outlined in HOP-3031.

• U.S. Citizen, resident, or officially recognized asylee - Applicant selected will be subject to government security investigation and must meet eligibility requirements for access to classified information at the level appropriate to the project requirements of the position.
• Minimum of 5 years of experience in cybersecurity, risk management, compliance, or audit, with at least 2 years of leadership or supervisory experience.
• Demonstrated experience with multiple compliance frameworks, including NIST 800-171, NIST 800-53, HIPAA, PCI-DSS, or similar.
• Strong understanding of controlled research requirements, particularly CUI, DFARS, and CMMC frameworks.
• Excellent verbal and written communication skills, including the ability to explain regulatory requirements to technical and non-technical audiences.
• Experience creating, managing, or reviewing compliance documentation such as SSPs, POA&Ms, or risk registers.
• Proven ability to manage and prioritize multiple projects across a distributed team.
• Familiarity with GRC platforms or tooling (e.g., IsoraGRC, ServiceNow GRC).

Relevant education and experience may be substituted as appropriate., * Experience working in higher education or academic research settings.

• Experience with CMMC Level 2 compliance readiness or pre-assessments.
• Experience managing or mentoring a cybersecurity or compliance team.
• Certifications such as CISSP, CAP, CISM, CISA, or relevant NIST/CMMC credentials.
• Familiarity with UT Austin's information security policies, research infrastructure, or compliance structure., A criminal history background check will be required for finalist(s) under consideration for this position., * E-Verify Poster (English and Spanish) [PDF]
• Right to Work Poster (English) [PDF]
• Right to Work Poster (Spanish) [PDF]

The Information Security Office at The University of Texas at Austin provides an outstanding benefits package to our staff. Those benefits include:

• Competitive health benefits (employee premiums covered at 100%, family premiums at 50%)
• Voluntary Vision, Dental, Life, and Disability insurance options
• Generous paid vacation, sick time, and holidays
• Teachers Retirement System of Texas, a defined benefit retirement plan, with employer matching funds
• Additional Voluntary Retirement Programs: Tax Sheltered Annuity 403(b) and a Deferred Compensation program 457(b)
• Flexible spending account options for medical and childcare expenses
• Robust free training access through LinkedIn Learning plus professional conference opportunities
• An exclusive incentive pay program
• A great physical office space should you prefer to work from campus
• Tuition assistance
• Expansive employee discount program including athletic tickets
• Free access to UT Austin's libraries and museums with staff ID card
• Free rides on all UT Shuttle and Austin CapMetro buses with staff ID card, * May work around standard office conditions
• Repetitive use of a keyboard at a workstation
• Use of manual dexterity
• This is a remote-eligible opportunity offering flexible work arrangements

The Clery Act requires all prospective employees be notified of the availability of the Annual Security and Fire Safety report. You may access the most recent report here or obtain a copy at University Compliance Services, 1616 Guadalupe Street, UTA 2.206, Austin, Texas 78701.