Advisor, Data Privacy, Security, and Classification

Founded in 2004, BME Strategies is a Massachusetts-based consulting firm specializing in the design, implementation, and evaluation of public health programs for local, regional, and state government partners. Our work supports evidence-based, community-driven solutions that strengthen public health systems and advance equity across the communities we serve. At BME, our clients are on the front lines of Public Health. Priorities may shift but our commitment to supporting our partners does not. We take pride in having multi-year, multi-project engagements, often working closely as an extension of their staff. Our success comes from our shared values: a bias toward action; optimistically collaborative; willingness to navigate ambiguity; minimal ego - no job is too small or big; pursuing the equitable solution; always learning, and; committed to quality at every stage.

BME Strategies is seeking an Advisor, Data Privacy, Security, and Classification to guide a data classification assessment for the Massachusetts Department of Public Health (DPH). The Advisor will assess how DPH classifies its data today and design a consistent, department-wide classification process that meets Commonwealth privacy, security, and regulatory requirements.

BME Org-Wide Responsibilities for Advisors (Subject Matter Experts):

• Leads or co-leads larger projects, technical & advisory, contributes to project design
• Mentorship Potential: mentors Associates and Senior Associates on projects when possible; serves as a technical resource for their practice area
• Business Development: manages projects to exemplary client satisfaction; contributes to and/or leads proposals
• Role expectations: 90% project work, 5% administrative work, and 5% business development work.

Role-Specific Responsibilities:

• Research data classification practices at peer public health, healthcare, and government organizations.
• Conduct stakeholder interviews, focus groups, and process walk-throughs to document current practices, including informal ones.
• Build a map of the legal, regulatory, privacy, and security requirements that apply to DPH data.
• Design classification levels, criteria, and decision rules, aligned with NIST SP 800-60 and FIPS 199.
• Draft the engagement's main deliverables, including the current-state assessment and recommendations.
• Serve as day-to-day contact for DPH's Privacy and Data Compliance Office and Office of General Counsel: prepare the questions they need to decide and record their decisions in the project decision log.

• Minimum 6 years experience required
• 2+ years in a consulting firm environment
• Demonstrated subject matter expertise in at least one practice area
• Capable of independent technical contribution
• 1-4+ years client-facing experience
• MPH or similar relevant graduate degree. 
• Ability to work independently and as part of a team in a fast-paced consulting environment.
• And an alignment with BME’s shared values. 
• Experience designing or assessing data classification, data governance, or information security programs in complex organizations with many data sources and business units.
• Working knowledge of NIST SP 800-60 and FIPS 199, and of privacy laws relevant to health data, such as HIPAA and 42 CFR Part 2.
• Experience in public health, healthcare, or state or federal government settings strongly preferred.
• Skill in facilitating interviews and focus groups and turning informal practices into clear documentation.
• Ability to work directly with legal and privacy officers and frame decisions for them.
• Strong writing skills; able to produce polished, client-ready reports and policy materials.
• Privacy or security certification (such as CIPP/US, CIPT, CISSP, or CDMP) is a plus.

• This is a full-time position based in a home office environment within the U.S.
• BME Strategies in a remote-first organization. This role may require occasional travel to client sites, conferences, or meetings as required.
• BME's work is organized around contracts that have defined scopes and timelines. As contracts conclude, we make every effort to transition team members to new projects that align with their practice area or skill set. As a result, the responsibilities of an employee hired for a particular position may adapt based on project needs and assignments.

• BME Strategies offers a competitive compensation package that includes:   
• 11 paid floating holidays each year, plus 4 weeks of additional PTO, giving employees flexibility to take time off when it matters most.
• Health, dental, and vision insurance, with 80% employer-paid coverage for the employee & 70% employer-paid coverage for dependents; 
• Health FSA and dependent care FSA;
• 401(k) with employer match;
• Employer-paid short-term and long-term disability insurance;
• One-time technology stipend;
• And opportunities for professional development and career growth.

• The salary range for this position is $87,360 - $120,640 per year.

Please note: New employees are typically brought into the organization at a salary between the range minimum and the salary range midpoint, dependent upon internal equity and the budgeted amount for the position.   

• To apply for this position, please complete and submit all information in the application link.
• We expect a large volume of applicants for this position and only those candidates invited to move forward in the interview process will be contacted. 
• AI Use: At BME Strategies, we value authenticity and want to hear directly from you about your experiences, skills, and perspective. Please ensure that your resume, application responses, and cover letters accurately reflect your own knowledge, experience, and thinking. While AI tools can be used for limited support, including proofreading, formatting, or improving clarity, AI should not be used to generate responses. We encourage you to respond in your own words and draw from your actual experiences.
• Important Notice on Recruitment Fraud: BME Strategies communicates with applicants only through email addresses ending @bmestrategies.com. We do not use third-party domains for recruitment outreach. If you receive communication from a different email address, please do not respond and report it to us at [email protected]
• Please note that BME Strategies is unable to sponsor work-related visas.
• BME Strategies is made up of individuals with different strengths, experiences, and backgrounds. Diversity not only includes race and gender identity but also age, disability status, veteran status, sexual orientation, religion, and many other parts of one’s identity. These varied points of view are key to our success, and inclusion is everyone's responsibility. BME Strategies is an equal opportunity employer. All qualified applicants will be considered for employment without unlawful discrimination based on race, color, creed, national origin, sex, age, disability, marital status, sexual orientation, military status, prior record of arrest or conviction, or current employment status.