Data Governance Specialist III

Overview

Fred Hutchinson Cancer Center is an independent, nonprofit organization providing adult cancer treatment and groundbreaking research focused on cancer and infectious diseases. Based in Seattle, Fred Hutch is the only National Cancer Institute-designated cancer center in Washington.

With a track record of global leadership in bone marrow transplantation, HIV/AIDS prevention, immunotherapy and COVID-19 vaccines, Fred Hutch has earned a reputation as one of the world's leading cancer, infectious disease and biomedical research centers. Fred Hutch operates eight clinical care sites that provide medical oncology, infusion, radiation, proton therapy and related services, and network affiliations with hospitals in five states.

Together, our fully integrated research and clinical care teams seek to discover new cures to the world's deadliest diseases and make life beyond cancer a reality.

At Fred Hutch we value collaboration, compassion, determination, excellence, innovation, integrity and respect. Our mission is directly tied to the humanity, dignity and inherent value of each employee, patient, community member and supporter. Our commitment to learning across our differences and similarities make us stronger. We seek employees who bring different and innovative ways of seeing the world and solving problems.

The Data Governance Specialist III designs, implements, and operates the enterprise data governance program within Fred Hutch's Information Security function. The role centers on protecting sensitive clinical, research, and operational data -- ensuring it is properly classified, controlled, and used in compliance with applicable regulations and institutional policy.

This role works closely with the Office of the Chief Data Officer (OCDO), GRC, Privacy, Legal, and research and clinical business units to put data governance into practice and brings both technical depth and policy fluency to one of the organization's most critical compliance functions.

Most Fred Hutch jobs require some on-campus work. However, there may be flexibility for certain positions. Please check with the recruiter if you are an out-of-state applicant interested only in working outside of the Seattle area.

• Own and maintain the enterprise data classification and handling program, including policies, standards, and data inventories.
• Develop and operate processes for data lifecycle management -- covering data ownership/stewardship, data lineage, retention, de-identification, and secondary use in research and clinical contexts.
• Partner with OCDO, Privacy, and Legal to ensure data governance policies are consistently applied across systems, cloud services, and research platforms.
• Provide governance guidance on projects involving data collection, integration, analytics, and AI/ML use cases, including IRB-adjacent data use considerations.

• Assess data-related risks across systems, applications, third-party vendors, and cloud environments; track and drive remediation.
• Support external audits and assessments involving data (HIPAA, HITRUST, research compliance), including evidence preparation and response coordination.
• Collaborate with Privacy and Legal to interpret and operationalize current and emerging regulations: HIPAA/HITECH (including the 2025 Security Rule updates), GDPR, the Common Rule, and FDA 21 CFR Part 11.
• Maintain data protection impact assessments, handling standards, and records of processing activities and policy exceptions.

• Recommend and oversee data protection technologies including DLP, CASB, DSPM, and data discovery/classification tools.
• Maintain enterprise data flow documentation: systems of record, data transfers, cross-border flows, and third-party obligations.
• Work with Security Operations monitoring for data-related threats (exfiltration, misuse); support incident response scoping and regulatory notification requirements.
• Define and report metrics on data governance program effectiveness for executive and regulatory audiences.

• Deliver targeted awareness training on data handling, classification, and secure use of…