Healthcare Privacy & Security Specialist (HIPAA / NIST 800-53 / Risk Assessments)

Changing Technologies, Inc. (CTI) is hiring a Privacy and Security Specialist for the North Carolina Department of Health and Human Services (NCDHHS) Privacy and Security Office (PSO), supporting the Rural Health Transformation Program (RHTP). You will lead privacy and security work for RHTP initiatives, review contracts and data-sharing agreements, find and reduce privacy and security risks, and make sure sensitive information is protected in line with PSO requirements and federal and state regulations.

What You Will Do

• Support privacy and security governance for RHTP initiatives
• Review contracts and agreements, including MOAs, MOUs, Business Associate Agreements (BAAs), and data-sharing agreements
• Review RFPs and RFQs for privacy and security regulatory requirements
• Identify and mitigate privacy and security risks
• Run privacy and security assessments, including risk assessments based on NIST SP 800-53 Rev 5
• Support third-party and vendor risk management and vendor oversight
• Support incident response, compliance, and audit activities
• Support data governance and data-flow reviews
• Develop privacy and security policies and procedures
• Build privacy and security by design into technology and business initiatives
• Support change management and security awareness
• Work with RHTP leadership, program teams, legal, IT, compliance, and external partners, * Must be authorized to work in the United States for the duration of the assignment
• CTI participates in E-Verify; employment eligibility for all hires is verified in compliance with applicable state and federal requirements
• This is a W2 engagement only. We do not work with 1099 or Corp-to-Corp (C2C) arrangements, and third-party or agency submissions will not be considered

Why This Role

• Protect sensitive health data in a statewide rural health transformation program
• Broad scope across contracts, risk assessments, incident response, and policy
• Contract of almost a full year with a state health agency, * This role is hybrid with on-site work at NCDHHS in Raleigh, NC. Can you work on site in Raleigh when required?

• 2+ years working with NC DHHS or another state government health and human services organization
• 5+ years supporting Medicaid, healthcare, public health, or human services programs
• 1+ year with RHTP Initiative 6 or a similar large-scale healthcare transformation initiative
• 5+ years implementing privacy and security by design in technology and business initiatives
• 5+ years with the NIST Cybersecurity Framework, NIST Privacy Framework, NIST SP 800-53, or similar frameworks
• 7+ years performing risk assessments based on NIST SP 800-53 Rev 5
• 5+ years with HIPAA Security Rule and Privacy Rule implementation
• 7+ years reviewing RFPs, RFQs, MOUs, and MOAs for privacy and security regulatory requirements, * This role requires 7+ years performing risk assessments based on NIST SP 800-53 Rev 5. Do you meet this requirement?, * Healthcare privacy and security: 5 years (Required)
• NIST SP 800-53 risk assessments: 7 years (Required)
• HIPAA Privacy and Security Rules: 5 years (Required)

Work Location: Hybrid remote in Raleigh, NC 27607