Data Governance & Policy Subject Matter Expert

Mind Moves

3d•$125 - $135•Remote

About The Position

Mind Moves is hiring a Data Governance & Policy Subject Matter Expert for an approximately six-month, part-time NIH project developing and evaluating privacy-preserving synthetic data modeled on dbGaP. The technical team will use generative modeling, including latent diffusion with differential privacy, to create synthetic genomic cohorts that preserve scientifically relevant statistical properties while mitigating participant-level disclosure risks. The role interprets source-data governance requirements and translates them into clear, implementable, and testable technical controls. This includes reviewing consent conditions, data-use limitations, access requirements, and applicable Data Use Certification (DUC) or Data Use Agreement (DUA) terms. Working with the technical team and NIH stakeholders, the SME will define governance and privacy evaluation criteria, assess residual disclosure risks, identify circumstances that may require additional review or authorization, and document requirements and decisions. The work supports NIH’s model-to-data approach to controlled-access research and requires careful attention to policy, security, privacy, regulatory, and ethical requirements. The SME will collaborate with the project’s technical lead, synthetic data scientists, integration engineers, program management team, NIH staff, scientists, and supporting partners. The position is US-based and 100% remote. The contract is approximately 540 hours total, or about 20 hours per week, with an estimated duration of six months from project initiation. Compensation is $125–$135 per hour. The opportunity has an immediate start date, applications are accepted on a rolling basis until filled, and selected candidates must complete a full background check. The interview process includes two to three interviews and a short hiring exercise.

Requirements

Demonstrated experience governing sensitive or controlled-access data, including interpreting consent conditions, data-use limitations, access requirements, authorization rules, and data-sharing agreements.
Proven ability to translate policy, contractual, regulatory, and ethical requirements into clear, implementable, and testable technical specifications, permission models, governance metadata, and acceptance criteria.
Understanding of data privacy, confidentiality, re-identification risks, data linkage, secondary use, and the challenges of enabling legitimate research while protecting individuals and respecting applicable restrictions.
Experience defining or evaluating access-control frameworks, permission matrices, authorization workflows, audit requirements, and data-use controls; ability to identify policy gaps, ambiguity, conflicting obligations, and edge cases requiring further review.
Ability to work effectively with data scientists, software engineers, security specialists, and architects to translate governance requirements into system designs and assess whether implemented controls satisfy agreed-upon requirements.
Demonstrated ability to assess competing requirements, distinguish essential safeguards from areas where flexibility may be appropriate, and recommend practical, defensible approaches balancing privacy, compliance, and scientific utility.
Excellent written and verbal communication skills, including explaining complex governance and privacy concepts to technical and nontechnical stakeholders and producing clear requirements, decision records, evaluation criteria, and project documentation.
Experience collaborating across multidisciplinary teams and engaging policy owners, researchers, technical teams, and other stakeholders to resolve questions, clarify requirements, and build consensus.
5+ years of professional experience in data governance, privacy, compliance, or policy.

Nice To Haves

Familiarity with dbGaP, the NIH Genomic Data Sharing Policy, Data Use Certifications (DUCs), and NIH security requirements for controlled-access data.
Understanding of human genetics, genomic research workflows, controlled-access repositories, and governance challenges associated with secondary use of genomic and health data.
Familiarity with frameworks such as the GA4GH Data Use Ontology (DUO) and GA4GH Passports.
Familiarity with synthetic data generation, differential privacy, privacy-preserving analytics, or techniques for evaluating disclosure risks.
Experience with machine-readable governance metadata, automated compliance checks, standardized data-use conditions, or policy-as-code.
Experience with federal contracting or NIH, NLM, or other HHS agencies, and familiarity with relevant research governance, privacy, and security frameworks.
Experience developing governance specifications, standard operating procedures, workflow definitions, decision frameworks, and implementation guidance.
Experience facilitating discussions among stakeholders with differing interpretations or priorities to reach practical, well-documented decisions.
Background in human genetics, biomedical, or public health data, for example VCF/PLINK files or GWAS studies.
Experience with model-to-data, trusted research environment, or secure data enclave approaches.
Experience on research or prototype projects with formal milestones and deliverables.

Responsibilities

Lead development of the Governance Metadata Model, defining machine-readable representations of consent conditions, data-use limitations, access tiers, authorization requirements, data access requests, Data Access Committee (DAC) scope, and audit records.
Translate consent conditions, data-use limitations, and applicable DUC or DUA terms into implementable permissions, decision rules, and technical requirements.
Define governance requirements and acceptance criteria for a governed-access interface prototype, including authorization, audit logging, and data egress controls.
Identify ambiguous, conflicting, or incomplete requirements and work with NIH stakeholders to establish documented interpretations and defensible implementation approaches.
Design the governance overlay and develop policy edge cases and adversarial test scenarios for a mock corpus reflecting dbGaP’s structure and accession conventions.
Define governance and privacy evaluation criteria for determining synthetic data suitability for development, testing, research, and sharing scenarios.
Collaborate with the technical team to assess disclosure risks, including memorization, re-identification, and membership inference.
Review findings concerning differential privacy guarantees, privacy budgets, and privacy–utility trade-offs, and contribute to interpretation and documentation of results.
Help establish criteria for determining when additional privacy review, institutional authorization, or restrictions on use or sharing may be necessary.
Contribute governance and privacy criteria to reviews of controlled-access, model-to-data, and synthetic data approaches, preregistered evaluation criteria, and project scorecards.
Advise on applicable NIH and federal requirements for handling controlled-access genomic data within the project’s secure environment.
Lead preparation of governance and privacy sections for project deliverables, including the data specification, the Verification and Disclosure-Risk & Leakage Report, and the final report and transition package.
Collaborate with NIH staff, the Mind Moves technical team, and supporting partners to resolve governance questions and document decisions.