Job Description Summary:

Reporting to the Chief Information Officer and serving on the IT Senior Leadership Team, the Senior Lead for Cybersecurity Policy and Compliance (“Senior Lead”) will serve as the organization’s leading subject matter expert on cybersecurity. The successful candidate will be responsible for maintaining a cybersecurity policy that is flexible enough to meet the demands of a national research center, but concrete enough to provide enforceable, actionable guidance to all the organization’s staff, including administrative staff, educators, researchers, IT staff, and others.

The Senior Lead is responsible for developing, implementing, managing, and evolving the organization's cybersecurity policies, standards, guidelines, and procedures. This individual will ensure adherence to relevant laws, regulations, industry standards, organizational policies, funder requirements, and internal requirements. The Senior Lead will provide expert guidance on compliance matters and drive the maturity of the cybersecurity compliance program, working in collaboration with the organization’s Research Security program, Office of General Counsel, and Contracts Office.

This role requires a deep understanding of federal cybersecurity frameworks and regulatory landscapes. The Senior Lead must be able to translate complex technical requirements into clear policies, take firm action with respect to compliance, and ensure that those actions do not disrupt research, educational, operational activities, and/or other mission-facing activities.

In addition to policy and compliance responsibilities, the Senior Lead will direct a small team that manages specific cybersecurity-related services and programs such as audit preparation & response, vendor security & privacy assessments, data preservation, cybersecurity aspects of legal holds, annual cybersecurity training, phishing simulation, and related cybersecurity services and programs.

Critically, the Senior Lead will serve as the point person for all cybersecurity incident responses, working closely with the Cybersecurity Operations group, which reports separately into UCAR’s IT Operations unit. During any incident response situations, the Senior Lead will be expected to coordinate and direct the activities of the Cybersecurity Operations group, serving as a temporary matrixed manager for the duration of the incident.

Position Details:

Visa Sponsored Job:

No

Relocation Assistance Eligible:

Yes

Job Location:

Boulder, Colorado

Position Type & Term:

Full time, Regular

Compensation Range:

Salary Range: $137,229 - $171,537*

*Final salary and rates are based on education, experience, skills relevant to the role.

Application Notes

Job Location: Boulder, Colorado

Job Type: Hybrid, 3 days/week minimum requirement in Boulder office

Position Type & Term: Full-Time, Regular
 

Application Deadline: This position will be posted until 11:59 PM MT on Sunday, November 9, 2025.

Required application materials: (preferably uploaded as a PDF):

• Resume/CV
• Cover Letter - Please address how your skills and experience meet the needs of this position (for more information, please refer to the Key Responsibilities and Knowledge, Skills, and Abilities sections of this job posting). ADDITIONALLY, please share specific examples of (1) your experience working with executive leadership, and (2) working in environments with distributed authority. Cover Letters that do not address the above will not be submitted for further consideration.

Background Checks: Conducted for candidates selected for hire. Learn more.
Work Location: Regardless of flexible work arrangements, UCAR requires ALL positions to be performed within the U.S., excluding U.S. Territories.

What You Will Do

Here is a brief summary of what one would expect to be generally responsible for in this role.

Key Responsibilities:

Policy & Standard Development:

• Lead the development, review, and c