Privacy Lead

Privacy Lead

Serve as the Privacy Lead supporting NIH CIT systems and services, ensuring privacy compliance across enterprise, cloud, network, hosting, collaboration, identity, endpoint, and other FISMA-reportable environments.

Lead development, review, update, and maintenance of privacy compliance artifacts, including Privacy Threshold Analyses (PTAs), Privacy Impact Assessments (PIAs), System of Records Notices (SORNs), data inventories, privacy requirements documentation, and supporting approval packages.

Evaluate NIH systems, data flows, system interfaces, business processes, and proposed changes to identify privacy risks involving Personally Identifiable Information (PII), Protected Health Information (PHI), sensitive data, and other information requiring protection.

Interpret and apply applicable privacy laws, regulations, policies, standards, and guidance, including the Privacy Act, E-Government Act, FISMA-related privacy requirements, HHS privacy policies, NIH privacy procedures, and relevant federal records and data-protection requirements.

Partner closely with System Owners, ISSOs, security engineers, program managers, legal/privacy offices, and other stakeholders to collect system information and ensure privacy requirements are incorporated throughout the system lifecycle.

Lead the collection, analysis, validation, and documentation of information from FISMA systems to support privacy reviews, system authorizations, data inventories, compliance reporting, and management decision-making.

Review proposed systems, enhancements, integrations, cloud migrations, data-sharing arrangements, and new uses of data to identify privacy implications and recommend appropriate safeguards, mitigations, and compliance actions.

Provide practical privacy-law and policy guidance to Government stakeholders on system design, data collection, data minimization, notice, consent where applicable, data retention, access, sharing, disclosure, and incident/breach considerations.

Track privacy risks, findings, action items, and remediation activities; maintain status reporting and escalate high-risk privacy issues, overdue actions, and material compliance gaps to program leadership.

Prepare clear privacy assessments, risk memoranda, compliance reports, executive briefings, status dashboards, and recommendations for technical and nontechnical audiences.

Develop and deliver privacy-awareness training, targeted guidance, job aids, and briefings for system owners, technical personnel, program staff, and other stakeholders.

Monitor changes in federal privacy legislation, HHS and NIH policy, agency guidance, and leading practices; assess program impact and recommend updates to processes, artifacts, controls, and training.

Lead and mentor privacy analysts or supporting personnel; establish work priorities, conduct quality reviews, and ensure privacy deliverables are complete, accurate, timely, and consistent.

Salary: $130,000 - $145,000/year.

Work location:

Hybrid, 2-3 days per week on-site in Bethesda, MD.

Minimum of three (3) to five (5) years of progressively responsible experience in federal privacy, privacy compliance, privacy program management, cybersecurity/privacy governance, information assurance, or a related discipline.

Candidates should demonstrate experience in:

• Developing and maintaining PTAs, PIAs, SORNs, privacy compliance documentation, data inventories, and related artifacts.
• Reviewing enterprise, cloud, hybrid, or FISMA-reportable systems for privacy risks and compliance obligations.
• Assessing the collection, use, retention, sharing, protection, and disposal of PII, PHI, sensitive data, or other regulated information.
• Applying federal privacy requirements, including the Privacy Act, E-Government Act privacy provisions, FISMA-related privacy requirements, HHS policies, and NIH procedures.
• Working directly with System Owners, technical teams, security personnel, program managers, legal/privacy stakeholders, and leadership.
• Collecting and validating system, data-flow, and business-process information needed for privacy reviews and reporting.
• Providing privacy guidance on system changes, cloud services, data exchanges, integrations, and policy or operational decisions.
• Delivering privacy training, briefings, reports, and decision-ready recommendations.
• Bachelor's degree from an accredited college or university in cybersecurity, information assurance, privacy, information systems, computer science, public policy, public administration, law, health information management, business administration, or a closely related discipline.
• Certified Information Privacy Professional/United States (CIPP/US), current and active
• Certified Information Privacy Manager (CIPM), current and active

Clearance Requirement:
Ability to obtain and maintain a Public Trust.

Desired

Qualifications:

• Master's degree in privacy, cybersecurity, information assurance, public policy, public administration, law, health information management, data governance, business administration,…