GenAI Risk Analyst (Information Technology Specialist I)

Job Description and Duties Under direction of the Information Technology Supervisor II, the Information Technology Specialist I (ITS I) serves as a Generative AI Risk Analyst within the Information Security & Privacy Section. The incumbent performs technical and risk-based evaluations of proposed, existing, and modified GenAI tools, systems, and AI-enabled software capabilities used by the Department or Regional Centers. The ITS I investigates AI system architecture, model behavior, integrations, and data handling to identify privacy, security, and compliance risks; evaluates safeguards; documents findings and mitigation recommendations; and supports responsible use of GenAI. The ITS I collaborates with program staff, system owners, IT Acquisitions, Legal, and vendors. Effective July 1, 2025, State employees are subject to a salary reduction of three percent in exchange for five hours per month of the Personal Leave. Please let us know how you heard about our position by taking this brief survey: https://www.research.net/r/ddsadmin You will find additional information about the job in the Duty Statement. Special Requirements The Statement of Qualifications (SOQ) must be numbered in the same order as the following areas, typed in 12-point Arial font, single spaced, and be no more than two pages in length. Applicants who fail to answer the questions or submit an SOQ may not be considered. • After reviewing the duty statement and desirable qualifications, please tell us about your knowledge, skills, and experience as it relates to performing technical and or risk based evaluations of GenAI and/or technical solutions for a team and/or organization. • Describe your experience applying a formal governance, compliance, or risk framework (e.g., NIST, ISO, SOC2, HIPAA, or internal enterprise frameworks). Explain how the framework informed your evaluation or decision-making. If you are using list eligibility from an on-line exam to qualify for this position, you MUST include with your application any documentation (i.e., copy of transcript, degree, license, etc.) to verify meeting the MQ’s or you may not be considered for the position. The MQs will be verified prior to interview and/or appointment. If it is determined that an applicant does not meet the MQs of the classification, the applicant may not be considered and withheld from the eligible list. Desirable Qualifications In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate: Knowledge of: GenAI risk assessments for HIPAA-covered entities, including evaluation of PHI exposure, data handling controls, and HIPAA compliance; formal GenAI-related training or certification and background in HIPAA privacy/security requirements; developing or reviewing AI or software product documentation, such as architecture diagrams, API specifications, data flow diagrams, or risk/security documentation; applying AI governance, responsible AI principles, privacy/security regulatory requirements, and statewide or enterprise evaluation frameworks (e.g., SIMM 5305-F, SIMM 150, NIST AI RMF, ISO 42001); working with vendors, procurement teams, legal counsel, or product owners to evaluate and negotiate technical or compliance requirements for AI or complex software tools. Ability to: Evaluate Generative AI or machine-learning systems at a technical level, including understanding model behavior, training data constraints, inference patterns, and system integration impacts; work in software engineering, machine learning engineering, product security, or technical roles, especially involving AI-enabled products or cloud-hosted SaaS platforms; translate AI system behavior, model limitations, and privacy/security risks into clear, actionable guidance for non-technical stakeholders; design or improve risk assessment methods, develop standardized documentation or templates, and maintain structured tracking systems or risk registers; utilize strong analytical skills, including the ability to identify subtle AI risks (hallucinations, data leakage, bias, model drift, retention risks, access misuse, prompt injection) and clearly document findings; serve as a liaison during technical investigations or security/privacy incidents involving AI or complex cloud systems.