Privacy and Security Specialist

Job Summary:

The NCDHHS Privacy and Security Office (PSO) is seeking a privacy and security professional to provide leadership and support for the Rural Health Transformation Program (RHTP). This role ensures compliance with federal and state regulations, manages privacy and security risks, and integrates privacy and security requirements across RHTP initiatives. The position collaborates with leadership, legal, IT, compliance, and external partners to maintain a strong culture of privacy, security, and regulatory adherence. Responsibilities:

• Provide privacy and security leadership and support for RHTP initiatives in alignment with PSO requirements and regulations.
• Support privacy and security governance activities and compliance audits.
• Review contracts and agreements including MOAs, MOUs, BAAs, and data-sharing agreements to ensure regulatory compliance.
• Identify and mitigate privacy and security risks related to sensitive information.
• Conduct privacy and security assessments and third-party/vendor risk management.
• Support incident response and change management processes.
• Develop and maintain policies and procedures related to privacy and security.
• Implement privacy and security by design principles in technology and business initiatives.
• Perform data-flow reviews and vendor oversight activities.
• Collaborate with RHTP leadership, program teams, legal, IT, compliance, and external partners.

Required Skills & Certifications:

• Minimum 7 years of knowledge in Federal privacy and security requirements including HIPAA Security and Privacy Rules.
• At least 5 years of experience working with NC DHHS or other state health and human services organizations.
• Minimum 5 years supporting Medicaid, healthcare, public health, or human services programs.
• Experience with RHTP Initiative 6 or similar large-scale healthcare transformation initiatives (minimum 1 year).
• Familiarity with NIST Cybersecurity Framework, NIST Privacy Framework, and NIST SP 800-53 standards (minimum 5 years).
• Experience performing risk assessments based on NIST 800-53 Rev 5 (minimum 5 years).
• Experience reviewing RFPs, RFQs, MOUs, and MOAs for privacy and security regulatory requirements (minimum 7 years).
• Experience implementing privacy and security by design within technology and business initiatives (minimum 5 years).

Preferred Skills & Certifications:

• Experience in data governance and security awareness training.
• Experience in incident response coordination and vendor oversight.
• Knowledge of change management processes related to privacy and security.

Special Considerations:

• All work must be completed on site at the designated location in Raleigh, NC.
• Absences longer than two weeks require prior approval and must provide contact information during absence.
• Vendor must disclose subcontracting and outsourcing details at the time of submission.
• Compliance with strict credential validation and submission accuracy requirements.
• Candidate dismissal rights if agreed upon return dates are not met.

Scheduling:

• Full-time, onsite work schedule for the duration of the assignment from October 26, 2026, through October 5, 2027.
• Vendor encouraged to submit candidates available for the entire assignment period.