Data Governance & Policy Subject Matter Expert

About Mind Moves

Mind Moves is a women-owned, Washington, D.C.-based firm helping businesses and government agencies harness the power of AI to advance their missions and deliver measurable impact. We bring deep expertise in predictive and generative AI, combining scientific rigor, technical innovation, and practical experience to develop and deploy solutions to complex, real-world challenges. Our team has delivered AI-powered products and services for Fortune 500 companies and major government organizations across healthcare, life sciences, financial services, and supply chain management—impacting millions of users worldwide and generating millions of dollars in revenue. At the heart of our approach is a commitment to human-centered, responsible AI. We integrate people, science, and technology to build solutions that are not only technically robust and innovative, but also trustworthy, practical, and aligned with the needs of the people and organizations they serve.

What you'll be doing

You’ll serve as the data governance and policy subject matter expert on an approximately six-month NIH project to develop and evaluate privacy-preserving synthetic data modeled on dbGaP, NIH’s controlled-access repository for genomic and phenotypic studies. The technical team will use generative modeling techniques, including latent diffusion with differential privacy, to generate synthetic genomic cohorts that preserve scientifically relevant statistical properties while mitigating participant-level disclosure risks.

Your role will be to interpret applicable source-data governance requirements and translate them into clear, implementable, and testable technical controls. This includes examining consent conditions, data-use limitations, access requirements, and applicable Data Use Certification (DUC) or Data Use Agreement (DUA) terms.

Working closely with the technical team and NIH stakeholders, you’ll help define governance and privacy criteria for evaluating synthetic data, assessing residual disclosure risks, and determining when additional review or authorization may be necessary for particular uses or sharing scenarios. You’ll document governance requirements and decisions, helping ensure that implemented controls respect applicable restrictions and participant protections while supporting legitimate scientific use.

The work supports NIH’s model-to-data approach to controlled-access research and requires careful consideration of applicable policy, security, privacy, regulatory, and ethical requirements.

Working with Mind Moves

You'll collaborate with the project's technical lead, synthetic data scientists, integration engineers, and program management team, while working closely with NIH staff and scientists. This role offers the chance to:

• Help NIH explore how realistic research data can reach more scientists without putting study participants at risk.

• See governance encoded and enforced in a working system, not just written up in the abstract.

• Operate at the intersection of genomics, privacy, and AI in a creative, mission-driven environment.

The contract will include:

Governance Framework and Technical Requirements

• Lead development of the Governance Metadata Model, defining machine-readable representations of consent conditions, data-use limitations, access tiers, authorization requirements, data access requests, Data Access Committee (DAC) scope, and audit records.

• Translate consent conditions, data-use limitations, and applicable Data Use Certification (DUC) or Data Use Agreement (DUA) terms into implementable permissions, decision rules, and technical requirements.

• Define governance requirements and acceptance criteria for a governed-access interface prototype, including authorization, audit logging, and data egress controls.

• Identify ambiguous, conflicting, or incomplete requirements and work with NIH stakeholders to establish documented interpretations and defensible implementation approaches.

Synthetic Data Governance and Privacy Assessment

• Design the governance overlay and develop policy edge cases and adversarial test scenarios for a mock corpus reflecting dbGaP’s structure and accession conventions.

• Define governance and privacy evaluation criteria for assessing the suitability of synthetic data for particular development, testing, research, and sharing scenarios.

• Collaborate with the technical team to assess disclosure risks, including memorization, re-identification, and membership inference.

• Review findings concerning differential privacy guarantees, privacy budgets, and privacy–utility trade-offs, and contribute to the interpretation and documentation of results.

• Help establish criteria for identifying when additional privacy review, institutional authorization, or restrictions on use or sharing may be necessary.

Research, Documentation, and Stakeholder Engagement

• Contribute governance and privacy criteria to the review of controlled-access, model-to-data, and synthetic data approaches, as well as to preregistered evaluation criteria and project scorecards.

• Advise on applicable NIH and federal requirements for handling controlled-access genomic data within the project’s secure environment.

• Lead preparation of governance and privacy sections for project deliverables, including the data specification, the Verification and Disclosure-Risk & Leakage Report, and the final report and transition package.

• Collaborate with NIH staff, the Mind Moves technical team, and supporting partners to resolve governance questions and document decisions.

Contractor has the following skills/background

Core (essential)

• Data Governance and Access Management: Demonstrated experience governing sensitive or controlled-access data, including interpreting consent conditions, data-use limitations, access requirements, authorization rules, and data-sharing agreements.

• Policy-to-Technical Translation: Proven ability to translate policy, contractual, regulatory, and ethical requirements into clear, implementable, and testable technical specifications, permission models, governance metadata, and acceptance criteria.

• Privacy and Disclosure Risk: Understanding of data privacy, confidentiality, re-identification risks, data linkage, secondary use, and the challenges of enabling legitimate research while protecting individuals and respecting applicable restrictions.

• Governance Frameworks and Controls: Experience defining or evaluating access-control frameworks, permission matrices, authorization workflows, audit requirements, and data-use controls. Ability to identify policy gaps, ambiguous requirements, conflicting obligations, and edge cases that require further review.

• Technical Collaboration: Ability to work effectively with data scientists, software engineers, security specialists, and architects to translate governance requirements into system designs and assess whether implemented controls satisfy agreed-upon requirements.

• Analytical Judgment and Problem-Solving: Demonstrated ability to assess competing requirements, distinguish essential safeguards from areas where flexibility may be appropriate, and recommend practical, defensible approaches that balance privacy, compliance, and scientific utility.

• Communication and Documentation: Excellent written and verbal communication skills, including the ability to explain complex governance and privacy concepts to technical and nontechnical stakeholders and produce clear requirements, decision records, evaluation criteria, and project documentation.

• Stakeholder Engagement: Experience collaborating across multidisciplinary teams and engaging policy owners, researchers, technical teams, and other stakeholders to resolve questions, clarify requirements, and build consensus.

Genomic data and privacy (nice to have)

• NIH genomic data governance: Familiarity with dbGaP, the NIH Genomic Data Sharing Policy, Data Use Certifications (DUCs), and NIH security requirements for controlled-access data.

• Genomic and biomedical research: Understanding of human genetics, genomic research workflows, controlled-access repositories, and the governance challenges associated with secondary use of genomic and health data.

• Genomic data use standards: Familiarity with frameworks such as the GA4GH Data Use Ontology (DUO) and GA4GH Passports.

• Privacy-preserving technologies: Familiarity with synthetic data generation, differential privacy, privacy-preserving analytics, or techniques for evaluating disclosure risks.

• Governance automation: Experience with machine-readable governance metadata, automated compliance checks, standardized data use conditions, or policy-as-code.

• Federal research and compliance: Experience with federal contracting or NIH, NLM, or other HHS agencies, and familiarity with relevant research governance, privacy, and security frameworks.

• Governance documentation and decision-making: Experience developing governance specifications, standard operating procedures, workflow definitions, decision frameworks, and implementation guidance.

• Stakeholder consensus-building: Experience facilitating discussions among stakeholders with differing interpretations or priorities to reach practical, well-documented decisions.

How you think (what we'll be looking for most closely)

• Judgment about risk: knowing which requirements are non-negotiable, which have flexibility, and how to explain the difference

• Precision: defining rules tightly enough that they can be encoded, tested, and audited, and spotting the edge cases where they break

• Pragmatism: finding a compliant path that still lets a small technical team move quickly, rather than defaulting to no

• Clear translation: explaining policy to engineers and scientists, and explaining technical privacy guarantees to policy and program staff, without losing accuracy

• Respect for participants: Recognizing the responsibilities associated with the consent conditions and data-use restrictions governing sensitive human data, and considering the potential consequences of disclosure or misuse.

Additional Experience That Would Be Valuable

• Experience with federal contracting, or with NIH, NLM, or other HHS agencies

• Background in human genetics, biomedical, or public health data (for example, VCF/PLINK files or GWAS studies)

• Experience with model-to-data, trusted research environment, or secure data enclave approaches

• Experience on research or prototype projects with formal milestones and deliverables

• 5+ years of professional experience in data governance, privacy, compliance, or policy

Proposal details

• Compensation range: $125-$135/hr

• Estimated contract duration: Approximately 6 months from project initiation

• Contract hours: Part-time, approximately 540 hours total (about 20 hours/week)

• Work locale: US based and 100% remote

• Security: If selected, candidates will be required to complete a full background check.

Timeline and process

This opportunity has an immediate start date. Applications accepted on a rolling basis until the position is filled. The contract interview process will include 2–3 interviews and the invitation to complete a short hiring exercise.