In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:
Knowledge of: GenAI risk assessments for HIPAA-covered entities, including evaluation of PHI exposure, data handling controls, and HIPAA compliance; formal GenAI-related training or certification and background in HIPAA privacy/security requirements; developing or reviewing AI or software product documentation, such as architecture diagrams, API specifications, data flow diagrams, or risk/security documentation; applying AI governance, responsible AI principles, privacy/security regulatory requirements, and statewide or enterprise evaluation frameworks (e.g., SIMM 5305-F, SIMM 150, NIST AI RMF, ISO 42001); working with vendors, procurement teams, legal counsel, or product owners to evaluate and negotiate technical or compliance requirements for AI or complex software tools.
Ability to: Evaluate Generative AI or machine-learning systems at a technical level, including understanding model behavior, training data constraints, inference patterns, and system integration impacts; work in software engineering, machine learning engineering, product security, or technical roles, especially involving AI-enabled products or cloud-hosted SaaS platforms; translate AI system behavior, model limitations, and privacy/security risks into clear, actionable guidance for non-technical stakeholders; design or improve risk assessment methods, develop standardized documentation or templates, and maintain structured tracking systems or risk registers; utilize strong analytical skills, including the ability to identify subtle AI risks (hallucinations, data leakage, bias, model drift, retention risks, access misuse, prompt injection) and clearly document findings; serve as a liaison during technical investigations or security/privacy incidents involving AI or complex cloud systems.