Manager, Privacy Compliance

This is a fully remote position, open to applicants in California, +4 more states.

📋 Description

• Assist in overseeing the current Privacy compliance program across various jurisdictions, with a primary emphasis on U.S. requirements and ensuring alignment with global privacy obligations, while suggesting enhancements as needed.

• Convert Legal guidance and regulatory mandates into policies, standards, and control expectations, guaranteeing a clear communication of compliance requirements for first-line teams.

• Oversee and sustain existing governance frameworks and standards for essential privacy program areas, which include:

• Data subject rights (DSAR) processes and service level agreements (SLAs)

• Data protection impact assessment (DPIA) governance and documentation standards

• Consent and preference management expectations

• Data retention and deletion requirements

• Collaborate with Product and Engineering teams to advise on and review the design and implementation of privacy controls, ensuring compliance with regulatory expectations while preserving second-line independence.

• Provide independent oversight and constructive challenge of first-line privacy control environments, which includes reviewing control design, identifying gaps, and tracking remediation efforts.

• Supervise privacy incident and breach response procedures from a governance standpoint, including the assessment of escalation, documentation, and outcomes, in collaboration with Legal on notification obligations.

• Maintain privacy risk registers and facilitate risk assessment processes, including oversight of DPIA, issue identification, and remediation tracking.

• Monitor compliance with privacy requirements and control expectations, including data subject rights processes, consent management, and regulatory obligations, escalating issues where gaps are discovered.

• Assist with audits, regulatory examinations, and reviews by bank partners by coordinating second-line input, evaluating materials, and tracking remediation actions.

• Generate and contribute to privacy monitoring and governance reports, including metrics and risk summaries for management and risk committees (e.g., RMC, CRMC).

• Collaborate with third-party risk functions to provide second-line oversight of privacy considerations in vendor and merchant onboarding and monitoring processes.

• Work alongside international compliance and DPO functions to ensure consistent application of privacy governance frameworks, without taking on DPO accountability.

• Foster privacy training and awareness by defining requirements and assessing program effectiveness in partnership with first-line execution teams.

⛳️ Requirements

• 6–10+ years of experience in privacy compliance, regulatory compliance, risk management, or a related control function, ideally within financial services, fintech, or a regulated environment.

• In-depth knowledge of U.S. privacy laws (e.g., CCPA/CPRA, GLBA) and familiarity with international regulations (e.g., GDPR, UK GDPR).

• Experience operating within a second-line of defense framework, encompassing governance, oversight, and independent challenge of first-line control environments.

• Proven ability to translate regulatory requirements into policies, standards, and control expectations (not direct control ownership or legal interpretation).

• Experience in reviewing control design and effectiveness, including participation in audits, regulatory examinations, or control testing initiatives.

• Strong skills in cross-functional collaboration, with the capacity to influence Product, Engineering, and Operations teams without direct ownership.

• Sound judgment and the ability to appropriately escalate and manage regulatory risk.

• Bachelor’s degree or equivalent practical experience; relevant certifications (e.g., CIPP, CIPM) are advantageous.

🏝️ Benefits

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents.

• Flexible Spending Wallets - generous stipends for expenditures on Technology, Food, various Lifestyle needs, and family-forming expenses.

• Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge.

• ESPP - An employee stock purchase plan enabling you to acquire shares of Affirm at a discount.