Privacy & Disclosure-Risk Analyst

Steampunk, Inc.; McLean (VA); On-site; USD 115,000 - 150,000; Full time

Job summary

Steampunk, Inc. in McLean, VA seeks a Privacy & Disclosure-Risk Analyst to evaluate privacy and data-disclosure risks in AI/ML models and federated learning environments.

You will design and run technical privacy tests, assess vulnerabilities, and collaborate with ML engineers and security teams to mitigate exposure.

The role requires deep knowledge of AI privacy attacks, risk frameworks like AI RMF, and clear communication of findings to technical and non-technical stakeholders.

Qualifications

• Bachelor's degree in a technical field or equivalent experience.
• 5+ years in cybersecurity, data privacy, ML/AI security or related disciplines.
• Ability to obtain and maintain a government security clearance.
• Experience assessing privacy risks in technical systems or data environments.
• Understanding of federated learning privacy risks and AI RMF guidance.
• Strong analytical, problem-solving, and communication skills.

Responsibilities

• Assess privacy and disclosure risks for AI/ML models and federated environments.
• Conduct model-leakage testing to identify exposure of sensitive data.
• Perform membership-inference testing to check training data exposure.
• Evaluate federated-update reconstruction privacy risks.
• Develop technical test scenarios and methodologies for privacy risk assessment.
• Analyze results to determine likelihood and impact of disclosure risks.
• Collaborate with ML engineers and cybersecurity teams to mitigate risks.
• Document methodologies, findings, and recommended actions.
• Communicate privacy risks to technical and non-technical stakeholders.
• Stay current with AI privacy attacks and evolving risk guidance.

Skills

Security clearance

AI/ML privacy testing

Analytical thinking

Communication skills

Collaboration

Education

Bachelor's degree in Computer Science/Data Science/AI/ML/Cybersecurity

Tools

Python

Job description

We are seeking a Privacy & Disclosure-Risk Analyst responsible for evaluating privacy and data disclosure risks associated with AI/ML models and federated learning environments. This role will perform technical privacy testing to identify potential exposure of sensitive or training data through model leakage, membership inference, federated-update reconstruction, and related disclosure-risk techniques.

The Privacy & Disclosure-Risk Analyst will analyze testing results, assess the potential impact of identified privacy vulnerabilities and information exposure, and collaborate with technical teams to identify and validate appropriate risk mitigation measures. This role requires a strong understanding of machine learning concepts, data privacy risks, applicable privacy requirements, and technical approaches for evaluating potential information disclosure from AI/ML systems.

Contributions

• Assess privacy and disclosure risks associated with AI/ML models, training data, and federated learning environments
• Conduct model-leakage testing to identify potential exposure of sensitive, protected, or training data
• Perform membership-inference testing to evaluate whether information about training data can be inferred from model behavior or outputs
• Conduct federated-update reconstruction testing to evaluate potential disclosure of sensitive information from federated learning workflows
• Evaluate AI/ML systems for privacy vulnerabilities, unintended information exposure, and potential disclosure risks
• Develop and execute technical test scenarios and methodologies for evaluating model and data privacy risks
• Analyze testing results to determine the likelihood, severity, and potential impact of identified disclosure risks, including potential impacts to individuals whose information may be exposed
• Evaluate the effectiveness of privacy-preserving controls and recommend appropriate risk mitigation measures
• Collaborate with machine learning engineers, data scientists, cybersecurity teams, and other technical stakeholders to identify and address privacy risks
• Conduct follow-up testing to validate remediation and privacy risk mitigation measures
• Document testing methodologies, technical findings, supporting evidence, risk assessments, and recommended mitigation actions
• Communicate technical privacy and disclosure risks to technical and non-technical stakeholders
• Maintain awareness of emerging AI/ML privacy attacks, disclosure-risk techniques, privacy-preserving machine learning approaches, and evolving AI privacy and risk management guidance

Qualifications

• Ability to obtain and maintain a government security clearance
• Bachelor’s degree in Computer Science, Data Science, Artificial Intelligence, Machine Learning, Cybersecurity, Information Technology, or a related technical discipline, or equivalent relevant experience
• 5+ years of experience in cybersecurity, data privacy, machine learning, AI/ML security, or related technical disciplines
• Experience assessing privacy, data exposure, or disclosure risks within technical systems or data environments
• Strong understanding of machine learning concepts, model training, model outputs, and associated data privacy risks
• Knowledge of AI/ML privacy attack techniques, including model leakage, membership inference, reconstruction, or related disclosure-risk methods
• Experience conducting technical security, privacy, data risk, or adversarial assessments
• Understanding of federated learning or distributed machine learning concepts and associated privacy risks
• Knowledge of privacy-preserving techniques and controls used to reduce unintended information disclosure
• Knowledge of AI risk management principles and frameworks, including the NIST AI Risk Management Framework (AI RMF) or similar guidance
• Ability to analyze technical testing results and assess the potential impact and severity of identified privacy risks
• Experience documenting technical testing methodologies, findings, risks, and recommended mitigation actions
• Strong analytical, problem-solving, communication, and collaboration skills

Preferred

• Hands-on experience conducting model-leakage, membership-inference, model inversion, reconstruction, or similar AI/ML privacy testing
• Hands-on experience assessing privacy and disclosure risks within federated learning environments
• Experience with differential privacy or other privacy-preserving machine learning techniques
• Experience with privacy-enhancing technologies, data minimization, de-identification, anonymization, or related data protection techniques
• Experience using Python or other programming languages for technical privacy, security, or machine learning analysis
• Knowledge of applicable federal privacy laws, regulations, policies, and standards related to sensitive data and information disclosure
• Familiarity with privacy requirements applicable to health, biomedical, research, or other sensitive data
• Experience working with sensitive, health, biomedical, research, or other protected data
• Experience working within federal government or other highly regulated environments
• Relevant privacy, cybersecurity, data science, or AI/ML certification

About Steampunk

Steampunk relies on several factors to determine salary, including but not limited to geographic location, contractual requirements, education, knowledge, skills, competencies, and experience. The projected compensation range for this position is $115,000 to $150,000. The estimate displayed represents a typical annual salary range for this position. Annual salary is just one aspect of Steampunk’s total compensation package for employees. Learn more about additional Steampunk benefits here.

Identity Statement

As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Steampunk is a Change Agent in the Federal contracting industry, bringing new thinking to clients in the Homeland, Federal Civilian, Health and DoD sectors. Through our Human-Centered delivery methodology, we are fundamentally changing the expectations our Federal clients have for true shared accountability in solving their toughest mission challenges. If you want to learn more about our story, visit http://www.steampunk.com.

We are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law. Steampunk participates in the E-Verify program.