Business Analyst/Consultant IV

Codetech•Madison, WI

1d•Remote

About The Position

The contractor will design, develop, and help establish a comprehensive privacy program for the Wisconsin Department of Administration (DOA). The work includes developing, documenting, and, where feasible, implementing or operationalizing privacy program policies and plans to strengthen the agency’s privacy governance, compliance, and risk management practices. The program may also inform future enterprise recommendations for Wisconsin executive branch agencies. Candidates must be Wisconsin residents or be willing to relocate to Wisconsin at their own expense before starting. The position can be performed 100% remotely from within Wisconsin. The work is a joint initiative of DOA’s Division of Legal Services and Division of Enterprise Technology. The contractor reports to DOA’s Lead Privacy Counsel, with dotted-line reporting responsibilities to the State of Wisconsin Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, and DOA’s Data Manager. The initial contract term is 6–9 months.

Requirements

8–10 years of relevant experience.
Excellent communication skills and ability to engage stakeholders at all levels.
Ability to translate complex technical and legal ideas for business stakeholders and decision-makers.
Demonstrated experience developing and implementing privacy program processes.
Strong knowledge of NIST Risk Management Frameworks, such as NIST RMF, NIST PF, and NIST CSF.
Candidates must be Wisconsin residents or willing to relocate to Wisconsin at their own expense before starting.

Nice To Haves

Knowledge of privacy laws and regulations such as GDPR, CCPA, and HIPAA.
Experience conducting privacy impact assessments and developing privacy processes.
Strong project management skills.
Ability to execute strategic privacy initiatives independently with general or minimal oversight.
Expertise in risk management, data governance, and compliance frameworks.
Professional certifications such as CIPP, CIPM, CIPT, or similar.

Responsibilities

Establish privacy procedures tailored to the agency’s operations.
Establish a privacy governance structure, including roles and responsibilities.
Define key performance indicators for measuring privacy program success.
Create processes for compliance with federal, state, and local privacy laws and regulations.
Create processes for Privacy Threshold Assessments and Privacy Impact Assessments.
Identify systems processing personally identifiable information and other regulated data, and identify associated stakeholders under NIST Risk Management Frameworks.
Create privacy communications materials, best-practice guidelines, and training.
Develop or recommend best practices to foster a culture of privacy compliance.
Work with the CISO and legal counsel to develop privacy mandates within existing incident response plans.
Work with the CISO and legal counsel to establish procedures for reporting and remediating privacy incidents.
Work with legal counsel to conduct privacy assessments of key vendors and partners.
Work with legal counsel to recommend standard contracting and data-sharing agreements or template appropriate data-protection and privacy clauses.
Assess and recommend privacy-enhancing technologies and automation tools.
Support integration of data and privacy tools and controls into agency IT systems, including the governance, risk, and compliance platform.
Collaborate with IT and security teams to embed privacy-by-design principles throughout the system development lifecycle.