Data Governance & Policy Subject Matter Expert

About Mind Moves
Mind Moves is a women-owned, Washington, D.C.-based firm helping businesses and government agencies harness the power of AI to advance their missions and deliver measurable impact. We bring deep expertise in predictive and generative AI, combining scientific rigor, technical innovation, and practical experience to develop and deploy solutions to complex, real-world challenges. Our team has delivered AI-powered products and services for Fortune 500 companies and major government organizations across healthcare, life sciences, financial services, and supply chain management—impacting millions of users worldwide and generating millions of dollars in revenue. At the heart of our approach is a commitment to human-centered, responsible AI. We integrate people, science, and technology to build solutions that are not only technically robust and innovative, but also trustworthy, practical, and aligned with the needs of the people and organizations they serve.
What you'll be doing
You’ll serve as the data governance and policy subject matter expert on an approximately six-month NIH project to develop and evaluate privacy-preserving synthetic data modeled on dbGaP, NIH’s controlled-access repository for genomic and phenotypic studies. The technical team will use generative modeling techniques, including latent diffusion with differential privacy, to generate synthetic genomic cohorts that preserve scientifically relevant statistical properties while mitigating participant-level disclosure risks.
Read more online!
Working with Mind Moves
You'll collaborate with the project's technical lead, synthetic data scientists, integration engineers, and program management team, while working closely with NIH staff and scientists.
Governance Framework and Technical Requirements
Lead development of the Governance Metadata Model, defining machine-readable representations of consent conditions, data-use limitations, access tiers, authorization requirements, data access requests, Data Access Committee (DAC) scope, and audit records.
Translate consent conditions, data-use limitations, and applicable Data Use Certification (DUC) or Data Use Agreement (DUA) terms into implementable permissions, decision rules, and technical requirements.
Define governance requirements and acceptance criteria for a governed-access interface prototype, including authorization, audit logging, and data egress controls.
Identify ambiguous, conflicting, or incomplete requirements and work with NIH stakeholders to establish documented interpretations and defensible implementation approaches.
Synthetic Data Governance and Privacy Assessment
Design the governance overlay and develop policy edge cases and adversarial test scenarios for a mock corpus reflecting dbGaP’s structure and accession conventions.
Define governance and privacy evaluation criteria for assessing the suitability of synthetic data for particular development, testing, research, and sharing scenarios.
Collaborate with the technical team to assess disclosure risks, including memorization, re-identification, and membership inference.
Review findings concerning differential privacy guarantees, privacy budgets, and privacy–utility trade-offs, and contribute to the interpretation and documentation of results.
Help establish criteria for identifying when additional privacy review, institutional authorization, or restrictions on use or sharing may be necessary.
Research, Documentation, and Stakeholder Engagement
Contribute governance and privacy criteria to the review of controlled-access, model-to-data, and synthetic data approaches, as well as to preregistered evaluation criteria and project scorecards.
Advise on applicable NIH and federal requirements for handling controlled-access genomic data within the project’s secure environment.
Lead preparation of governance and privacy sections for project deliverables, including the data specification, the Verification and Disclosure-Risk & Leakage Report, and the final report and transition package.
Collaborate with NIH staff, the Mind Moves technical team, and supporting partners to resolve governance questions and document decisions.
Contractor has the following skills/background
Core (essential)
Data Governance and Access Management: Demonstrated experience governing sensitive or controlled-access data, including interpreting consent conditions, data-use limitations, access requirements, authorization rules, and data-sharing agreements.
Policy-to-Technical Translation: Proven ability to translate policy, contractual, regulatory, and ethical requirements into clear, implementable, and testable technical specifications, permission models, governance metadata, and acceptance criteria.
Privacy and Disclosure Risk: Understanding of data privacy, confidentiality, re-identification risks, data linkage, secondary use, and the challenges of enabling legitimate research while protecting individuals and respecting applicable restrictions.
Governance Frameworks and Controls: Experience defining or evaluating access-control frameworks, permission matrices, authorization workflows, audit requirements, and data-use controls. Ability to identify policy gaps, ambiguous requirements, conflicting obligations, and edge cases that require further review.
Technical Collaboration: Ability to work effectively with data scientists, software engineers, security specialists, and architects to translate governance requirements into system designs and assess whether implemented controls satisfy agreed-upon requirements.
Analytical Judgment and Problem-Solving: Demonstrated ability to assess competing requirements, distinguish essential safeguards from areas where flexibility may be appropriate, and recommend practical, defensible approaches that balance privacy, compliance, and scientific utility.
Communication and Documentation: Excellent written and verbal communication skills, including the ability to explain complex governance and privacy concepts to technical and nontechnical stakeholders and produce clear requirements, decision records, evaluation criteria, and project documentation.
Stakeholder Engagement: Experience collaborating across multidisciplinary teams and engaging policy owners, researchers, technical teams, and other stakeholders to resolve questions, clarify requirements, and build consensus.
Genomic data and privacy (nice to have)
NIH genomic data governance: Familiarity with dbGaP, the NIH Genomic Data Sharing Policy, Data Use Certifications (DUCs), and NIH security requirements for controlled-access data.
Genomic and biomedical research: Understanding of human genetics, genomic research workflows, controlled-access repositories, and the governance challenges associated with secondary use of genomic and health data.
Genomic data use standards: Familiarity with frameworks such as the GA4GH Data Use Ontology (DUO) and GA4GH Passports.
Privacy-preserving technologies: Familiarity with synthetic data generation, differential privacy, privacy-preserving analytics, or techniques for evaluating disclosure risks.
Governance automation: Experience with machine-readable governance metadata, automated compliance checks, standardized data use conditions, or policy-as-code.
Federal research and compliance: Experience with federal contracting or NIH, NLM, or other HHS agencies, and familiarity with relevant research governance, privacy, and security frameworks.
Governance documentation and decision-making: Experience developing governance specifications, standard operating procedures, workflow definitions, decision frameworks, and implementation guidance.
Stakeholder consensus-building: Experience facilitating discussions among stakeholders with differing interpretations or priorities to reach practical, well-documented decisions.
How you think (what we'll be looking for most closely)
Judgment about risk: knowing which requirements are non-negotiable, which have flexibility, and how to explain the difference
Precision: defining rules tightly enough that they can be encoded, tested, and audited, and spotting the edge cases where they break
Pragmatism: finding a compliant path that still lets a small technical team move quickly, rather than defaulting to no
Clear translation: explaining policy to engineers and scientists, and explaining technical privacy guarantees to policy and program staff, without losing accuracy
Respect for participants: Recognizing the responsibilities associated with the consent conditions and data-use restrictions governing sensitive human data, and considering the potential consequences of disclosure or misuse.
Additional Experience That Would Be Valuable
Experience with federal contracting, or with NIH, NLM, or other HHS agencies
Background in human genetics, biomedical, or public health data (for example, VCF/PLINK files or GWAS studies)
Experience with model

Work arrangement
Yes