Privacy Lead

Gunnison Consulting Group; Bethesda (MD); Hybrid; USD 130,000 - 145,000; Full time

Benefits offered by this job

3 weeks of Personal Leave your first 3

11 paid Holidays each year

5 days of Flexible Time Off each year

401(k) company match at 50% up to 10%

Medical, Dental and Vision Insurance

Life and Disability Insurance

Public Transportation Subsidies

Certifications and Training Allowance—

Job summary

Gunnison Consulting Group seeks a Privacy Lead to support NIH CIT systems, ensuring privacy compliance across enterprise environments in a hybrid role in Bethesda, MD.

You will develop PTAs, PIAs, SORNs, data inventories, and privacy documentation; identify PII/PHI risks; advise stakeholders on safeguards throughout the system lifecycle.

Requires 3–5 years federal privacy experience, CIPP/US and CIPM, and ability to obtain a Public Trust.

Qualifications

• Minimum 3–5 years of federal privacy, privacy compliance, or related governance experience.
• Experience developing and maintaining PTAs, PIAs, SORNs, privacy documentation, and data inventories.
• Ability to assess PII/PHI and other sensitive data handling in line with federal requirements.
• Knowledge of Privacy Act, E-Government Act, FISMA privacy requirements, HHS NIH policies.

Responsibilities

• Lead development and maintenance of privacy artifacts (PTAs, PIAs, SORNs, data inventories).
• Identify and document privacy risks in PII/PHI across enterprise, cloud, and hybrid environments.
• Apply federal privacy requirements in system design, operation, and retention.
• Collaborate with System Owners, ISSOs, security engineers, legal/privacy teams, and leadership.
• Prepare privacy assessments, risk memos, compliance reports, and executive dashboards.
• Deliver privacy guidance and training to technical staff, program owners, and stakeholders.

Skills

Privacy leadership

Regulatory compliance

Stakeholder collaboration

Privacy law knowledge

Risk assessment

Education

Bachelor’s degree in a related field

CIPP/US

CIPM

CIPT

CISSP

CAP

CISM

CISA

CRISC

CHPS

CHPC

Tools

PTAs

PIAs

SORNs

Data inventories

Job description

Description

* This position is contingent upon a future opening with Gunnison.

Salary: $130,000 - $145,000/year

Work location: Hybrid, 2-3 days per week on-site in Bethesda, MD.

• Serve as the Privacy Lead supporting NIH CIT systems and services, ensuring privacy compliance across enterprise, cloud, network, hosting, collaboration, identity, endpoint, and other FISMA-reportable environments.
• Lead development, review, update, and maintenance of privacy compliance artifacts, including Privacy Threshold Analyses (PTAs), Privacy Impact Assessments (PIAs), System of Records Notices (SORNs), data inventories, privacy requirements documentation, and supporting approval packages.
• Evaluate NIH systems, data flows, system interfaces, business processes, and proposed changes to identify privacy risks involving Personally Identifiable Information (PII), Protected Health Information (PHI), sensitive data, and other information requiring protection.
• Interpret and apply applicable privacy laws, regulations, policies, standards, and guidance, including the Privacy Act, E-Government Act, FISMA-related privacy requirements, HHS privacy policies, NIH privacy procedures, and relevant federal records and data‑protection requirements.
• Partner closely with System Owners, ISSOs, security engineers, program managers, legal/privacy offices, and other stakeholders to collect system information and ensure privacy requirements are incorporated throughout the system lifecycle.
• Lead the collection, analysis, validation, and documentation of information from FISMA systems to support privacy reviews, system authorizations, data inventories, compliance reporting, and management decision‑making.
• Review proposed systems, enhancements, integrations, cloud migrations, data‑sharing arrangements, and new uses of data to identify privacy implications and recommend appropriate safeguards, mitigations, and compliance actions.
• Provide practical privacy-law and policy guidance to Government stakeholders on system design, data collection, data minimization, notice, consent where applicable, data retention, access, sharing, disclosure, and incident/breach considerations.
• Track privacy risks, findings, action items, and remediation activities; maintain status reporting and elevate high-risk privacy issues, overdue actions, and material compliance gaps to program leadership.
• Prepare clear privacy assessments, risk memoranda, compliance reports, executive briefings, status dashboards, and recommendations for technical and nontechnical audiences.
• Develop and deliver privacy‑awareness training, targeted guidance, job aids, and briefings for system owners, technical personnel, program staff, and other stakeholders.
• Monitor changes in federal privacy legislation, HHS and NIH policy, agency guidance, and leading practices; assess program impact and recommend updates to processes, artifacts, controls, and training.
• Lead and mentor privacy analysts or supporting personnel; establish work priorities, conduct quality reviews, and ensure privacy deliverables are complete, accurate, timely, and consistent.

Requirements

Minimum of three (3) to five (5) years of progressively responsible experience in federal privacy, privacy compliance, privacy program management, cybersecurity/privacy governance, information assurance, or a related discipline.

Candidates should demonstrate experience in:

• Developing and maintaining PTAs, PIAs, SORNs, privacy compliance documentation, data inventories, and related artifacts.
• Reviewing enterprise, cloud, hybrid, or FISMA-reportable systems for privacy risks and compliance obligations.
• Assessing the collection, use, retention, sharing, protection, and disposal of PII, PHI, sensitive data, or other regulated information.
• Applying federal privacy requirements, including the Privacy Act, E‑Government Act privacy provisions, FISMA‑related privacy requirements, HHS policies, and NIH procedures.
• Working directly with System Owners, technical teams, security personnel, program managers, legal/privacy stakeholders, and leadership.
• Collecting and validating system, data‑flow, and business‑process information needed for privacy reviews and reporting.
• Providing privacy guidance on system changes, cloud services, data exchanges, integrations, and policy or operational decisions.
• Delivering privacy training, briefings, reports, and decision‑ready recommendations.
• Bachelor’s degree from an accredited college or university in cybersecurity, information assurance, privacy, information systems, computer science, public policy, public administration, law, health information management, business administration, or a closely related discipline.
• Certified Information Privacy Professional/United States (CIPP/US), current and active
• Certified Information Privacy Manager (CIPM), current and active

Clearance Requirement: Ability to obtain and maintain a Public Trust.

Desired Qualifications:

• Master’s degree in privacy, cybersecurity, information assurance, public policy, public administration, law, health information management, data governance, business administration, or a related discipline.
• Certified Information Privacy Technologist (CIPT)
• Certified Information Systems Security Professional (CISSP)
• Certified Authorization Professional (CAP)
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Healthcare Privacy and Security (CHPS)
• Certified in Healthcare Privacy Compliance (CHPC)
• Health Insurance Portability and Accountability Act (HIPAA) privacy/security training
• Federal Privacy Act, FISMA, NIST RMF, privacy impact assessment, or federal records‑management training
• Project Management Professional (PMP) or ITIL Foundation
• Cloud privacy, cloud security, data governance, or data‑protection training

The salary range for this position depends upon multiple factors including location, the individual's knowledge, skills, competencies, and experience, and contract‑specific budget constraints and organizational requirements.
Gunnison Consulting Group's total compensation package also includes bonus and profit‑sharing opportunities, depending on company and employee performance. Available employee benefits include:

• 3 weeks of Personal Leave your first year
• 11 paid Holidays each year
• 5 days of Flexible Time Off each year for approved training or certifications (self‑study is ineligible)
• 401(k) company match at 50% up to 10% of your salary
• Medical, Dental and Vision Insurance
• Life and Disability Insurance
• Public Transportation Subsidies
• Certifications and Training Allowance - Up to $5,000/year!

Why Join Gunnison?

• Gunnison takes on ambitious projects. We target fun, challenging work that requires creative thinking and innovation.
• Quality is our top priority.
• Gunnison employee benefits meet or exceed what other companies in the Washington, D.C. metropolitan area offer.
• There is a great sense of camaraderie at Gunnison. This is an atmosphere we will maintain as we continue to grow.
• We are growing rapidly and the opportunity for individual professional growth with Gunnison is outstanding.
• We hire for careers at Gunnison, not to fill a position.

Equal Opportunity/Affirmative Action Employer. Must be eligible for employment in the United States. We are unable to sponsor candidates at this time.
In 1994 Gunnison began serving the greater Washington, D.C. metro area, focused on tackling our customers' most ambitious technology projects. By creating a culture dedicated to enabling our customers and employees to achieve more than they ever thought they could, the company has thrived for over 25 years.