Privacy and Compliance Specialist

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee and uphold Virta's privacy compliance program, which includes policies, procedures, and documentation.

• Facilitate and manage privacy impact assessments, Data Protection Impact Assessments (DPIAs), and data protection evaluations for new products, features, and partnerships with vendors.

• Keep accurate records of processing activities, data inventories, and data flow diagrams.

• Track and implement requirements as per HIPAA, CCPA/CPRA, various state privacy regulations, and relevant frameworks.

• Apply and endorse Privacy by Design principles throughout Virta's operations.

• Assist with data subject rights requests and manage privacy incident response procedures.

• Act as the primary point of contact for privacy and data-related inquiries from customers, potential clients, and partners.

• Craft and update responses to privacy questionnaires, RFPs, security assessments, and due diligence inquiries.

• Aid in the negotiation and review of Data Processing Agreements and Business Associate Agreements.

• Lead privacy and compliance projects from inception to execution, overseeing timelines, stakeholders, and deliverables.

• Create and deliver privacy training and awareness initiatives.

• Develop and maintain privacy metrics, dashboards, and reports for leadership and Board visibility.

• Identify areas for enhancement and automation of privacy processes and workflows.

• Complete at least one PIA/DPIA within the initial 90 days.

• Establish consistent workflows for handling privacy questionnaires, RFPs, and inquiries from customers/partners.

• Review Data Subject Access Requests (DSAR) and privacy incident response procedures to identify potential improvements.

• Initiate the development of privacy metrics and reporting for assessing program performance and risk posture.

⛳️ Requirements

• 4 to 7 years of experience in privacy, compliance, data protection, or a related discipline.

• Proficient understanding of HIPAA, state consumer privacy laws such as CCPA/CPRA, and regulations concerning health data.

• Proven project management capabilities with the ability to juggle multiple workstreams at once.

• Experience with privacy impact assessments, incident response, or Data Subject Access Request (DSAR) processes.

• Excellent written and verbal communication skills, with the capacity to simplify complex privacy requirements into actionable guidance.

• Proactive utilization of AI tools to enhance individual productivity and efficiency.

• Required to adhere to Virta’s security and privacy protocols and maintain strict confidentiality regarding patient information.

• Must possess legal authorization to work in the United States.

• Corporate positions are not available in AK, AR, DE, HI, ME, MS, NM, OK, SD, VT, or WI.

🏝️ Benefits

• Equity.

• Remote-first work environment.

• Security and privacy training.

• Compensation structure based on location.

• Benefits information available on the Careers page.