Job Description & Details
This is a heavy-duty governance and risk management gig for someone who knows healthcare compliance inside and out, specifically within state health and human services programs. You'll be dropping into Raleigh to wrangle privacy and security policies for massive transformation initiatives like RHTP. If you enjoy deep-diving into regulatory frameworks and untangling data-sharing agreements, this one's right in your wheelhouse.
What You'll Actually Be Doing
Expect to spend a solid chunk of your day reviewing contracts, MOAs, MOUs, and BAAs to ensure ironclad data protection before any ink dries on a partnership. You'll work closely with legal, IT, and program teams to run risk assessments, handle third-party vendor oversight, and embed privacy-by-design into new technical rollouts. It's an operational role where you'll constantly bridge the gap between high-level regulatory mandates and actual on-the-ground implementation.
The Core Tech Stack
You don't necessarily need to be writing code, but you do need an intimate, working fluency with NIST frameworks—specifically NIST SP 800-53 Rev 5, the NIST Cybersecurity Framework, and the NIST Privacy Framework. HIPAA Security and Privacy Rules are your bread and butter, and you must know how to translate those federal requirements into actual workflows for large-scale public health programs.
Interview Expectations
Be ready for the hiring manager to throw a complex scenario your way involving a multi-agency data-sharing agreement that violates HIPAA or NIST 800-53 controls; they want to see how you tactfully push back while keeping the project moving. They'll also likely grill you on your experience reviewing RFPs and MOAs for RHTP Initiative 6, so brush up on how you audit vendor compliance under tight public sector timelines.
Application Advice
Your resume needs to heavily feature acronyms like BAA, MOU, MOA, and NIST 800-53 right at the top so the ATS picks them up immediately. Make sure you explicitly highlight your direct experience with Medicaid or state health and human services, as well as the exact number of years you've spent doing privacy-by-design implementations.