Principal Privacy Biostatistician - Risk Analytics

Location: Remote role based out of hirify.global's headquarters in the Greater Seattle area; applicants must be authorized to work in the United States. Visa sponsorship is not available.

Base pay: $160,000–$180,000 per year, with possible incentive pay and stock options.

Company

hirify.global builds a health provider-led data platform that helps researchers, clinicians, and families make better healthcare decisions.

What you will do

• Own the statistical disclosure control and de-identification framework, including methodological standards, risk thresholds, documentation, and platform-level governance.
• Sign Expert Determinations under 45 CFR §164.514(b)(1) for complex, novel, and high-visibility data products, documenting that re-identification risk is very small.
• Review and co-sign determinations prepared by Senior and staff Privacy Biostatisticians and govern peer review and case-defense processes.
• Develop risk methodologies for genomic, linked multi-modality, and AI/ML-derived data products with Clinical Informatics, Legal, Product, Security, and Engineering.
• Evolve profile-level risk justification methods, including dynamic k-anonymity thresholds, quasi-identifier ranking, suppression hierarchies, drift-triggered re-determination, and process-level determinations.
• Represent hirify.global with health system members, customers, auditors, regulators, and the scientific community while mentoring biostatisticians toward independent signing authority.

Requirements

• PhD in biostatistics, statistics, epidemiology, or a related quantitative field, or a Master's degree with equivalent experience and technical leadership.
• 10+ years applying statistical methods to patient health information, including extensive hands-on statistical disclosure control and de-identification experience.
• Prior formal experience signing HIPAA Expert Determinations, internally or as an external consultant or expert witness, with documented cases across multiple data modalities.
• Experience defining and implementing de-identification methodology at organizational or platform scale, not only for individual datasets.
• Deep experience with non-structured data such as imaging and/or clinical notes in addition to structured EHR or claims data, including linked-modality risk.
• Expert ability to reason across the HIPAA Privacy Rule and Security Rule when estimating risk.
• Exceptional written and verbal communication skills, including audit-ready documentation and explanations for executives, partners, and regulators.
• Experience analyzing Real World Data in a research setting.
• Demonstrated success mentoring senior technical staff and developing others toward independent signing authority.

Nice to have

• Experience defending Expert Determinations in regulatory, audit, litigation, or expert-witness settings.
• Experience designing and governing process Expert Determinations at scale.
• Advanced hands-on experience with SDC tools such as sdcMicro and dynamic, continuously revalidated risk methodologies.
• Familiarity with HL7, FHIR, and DICOM PS3.15 Annex E.
• Hands-on genomic data privacy experience, including VCF-level re-identification and familial risk.
• Peer-reviewed publications, conference presentations, or contributions to industry standards in privacy, disclosure control, or health data.
• Experience building or leading a privacy statistics or risk analytics function.

Culture & Benefits

• Meaningful work on a health data platform with established leadership and strong funding.
• Comprehensive medical, dental, and vision insurance, plus a 401(k) plan.
• Flexible work hours, work/life autonomy, and flexible paid time off.
• Generous parental leave and professional development and training opportunities.
• Regular virtual and in-person team activities.
• Some roles may receive incentive pay and stock options.