Privacy & Security Analyst

This role places you right in the middle of public sector healthcare compliance at NCDHHS. You will spend your days bridging the gap between rigid regulatory mandates and actual technical execution, ensuring sensitive citizen data doesn't leak while helping teams ship projects safely.

What You'll Actually Be Doing

Expect to spend a significant chunk of your week reviewing systems, analyzing access management controls, and running risk assessments on new and legacy applications. You'll be deep in the weeds of audit preparations, tracking down compliance gaps, writing remediation plans, and partnering with infrastructure and software engineering teams to make sure security best practices actually get implemented instead of just sitting in a PDF document.

The Core Tech Stack

You need to know your way around major regulatory and security frameworks like HIPAA, HITECH, NIST, and IRS 1075 like the back of your hand. This isn't a hands-on keyboard engineering gig; it's a governance, risk, and compliance (GRC) role where your technical fluency in vulnerability management, incident response, and cloud environments (Azure or AWS) will make or break your credibility with the engineering teams you audit.

Interview Expectations

Expect the hiring panel to hit you with real-world scenarios, such as asking you to walk through how you would handle a sudden HIPAA data breach notification or how you would remediate a critical compliance gap when a business unit pushes back against a security control. They aren't looking for textbook definitions here; they want to see how you balance rigorous risk management with pragmatic government bureaucracy and delivery timelines.

Application Advice

Your resume needs to heavily feature acronyms and frameworks like HIPAA, NIST, HITECH, and GRC because the ATS will ruthlessly filter for them. Ditch the generic duties section and explicitly call out quantifiable risk assessments you've led, audits you've survived, and security policies you've authored, especially if any of that background happened in the public sector or healthcare.