Principal Compliance Lead, Security – COPPA, GDPR Control Testing

This is a fully remote position, open to applicants in United States.

📋 Description

• Interpret GDPR and COPPA stipulations into concrete, testable security measures.

• Create and execute ongoing control assessments, which include sampling, evidence gathering, and re-testing, across applications, websites, SDKs, analytics, advertising, and vendor integrations.

• Validate age-verification, parental consent processes, data minimization, retention, deletion, and access flows for users under the age of 13.

• Oversee the security aspects of GDPR Article 32 (security of processing) and Article 25 (data protection by design and by default).

• Maintain and evaluate controls related to data subject requests, records of processing, retention, and cross-border data transfers.

• Provide security insights for Data Protection Impact Assessments (DPIAs) and vendor and processor evaluations, ensuring breach notification processes are prepared for the 72-hour deadline.

• Track findings to resolution with engineering and product leaders, reporting on control effectiveness to management.

• Prepare for and lead responses to audits, regulatory inquiries, and partner or platform privacy assessments.

• Stay updated on changes to GDPR and UK GDPR guidance, the FTC COPPA Rule, and children's privacy laws in U.S. states, updating controls as necessary.

• Mentor and support junior members of the compliance and security teams.

⛳️ Requirements

• Over 10 years of experience in security compliance, governance, risk management, privacy engineering, or technology risk, including more than 4 years in a senior or lead role.

• Practical experience in testing controls for COPPA, including consent frameworks, age verification, and data handling for children under 13.

• Comprehensive knowledge of GDPR and UK GDPR as they relate to security and engineering, particularly Articles 25, 30, 32, 33, and 35.

• Demonstrated ability to convert legal language into straightforward, testable control specifications.

• Experience in developing and managing control testing programs with documentation suitable for audits.

• Familiarity with at least one significant framework: NIST (CSF or Privacy Framework), ISO 27001/27701, or SOC 2.

• Strong grasp of cloud, mobile, and web data flows, identity and access management, encryption, logging, and data retention protocols.

• Exceptional written and verbal communication skills, with the ability to engage effectively from the boardroom to the engineering team.

• Bachelor’s degree in a relevant discipline or equivalent practical experience.

🏝️ Benefits

• 15% bonus

• Equity

• Comprehensive Medical coverage (Blue Cross Blue Shield)

• Dental coverage

• Vision coverage

• Company-paid Life Insurance

• Employer contributions to employee Health Savings Accounts (HSA)

• 401k Plan with Safe Harbor company matching

• Flexible vacation policy

• Paid company holidays

• Company-provided technology package

• Relocation assistance when applicable, including travel and company-funded housing for the initial 90 days