About the roleAs Privacy & AI Governance Analyst at Vasion, you will own the execution of our privacy program and AI governance framework, two of the company's highest-externally-visible compliance domains. This is a hands-on builder role, not a coordinator role. You will inherit programs in motion and be expected to run them independently from day one. You will report directly to the General Counsel & Chief Compliance Officer and serve as the company's subject matter expert on all things privacy and AI governance. You will work cross-functionally with Product, Engineering, Security, Sales, Marketing, HR, and Legal to embed compliance into how Vasion builds and operates. You will also support Vasion's obligations as a group health plan sponsor as the company transitions toward a self-funded insurance model. This role is an opportunity to build privacy and AI governance infrastructure at a company in a genuine market moment, where FedRAMP authorization, ISO 42001 certification, and a growing federal customer base make compliance a strategic differentiator, not a back-office function.
What you'll do- Own the end-to-end DPA review, redline, and execution process - with authority to approve standard customer DPAs without escalation
- Manage data subject rights (DSR) intake, response, and tracking across GDPR, CCPA, and applicable US state privacy laws
- Conduct Privacy Impact Assessments (PIAs) for new product features, integrations, and data processing activities
- Maintain and update the subprocessor register and manage vendor subprocessor compliance notifications
- Lead cookie consent management implementation in partnership with Product and Engineering
- Own privacy policy maintenance, including coordinating updates with Marketing and ensuring accurate web publication
- Manage Vasion's EU-US Data Privacy Framework compliance obligations
- Support international privacy obligations across Vasion's Germany, UK, and Australia entities
- Lead data mapping and privacy GRC tool deployment (active evaluation in progress)
- Deliver GDPR and privacy training to internal teams
AI Governance Program Execution- Maintain Vasion's AI model inventory, bias testing documentation, and audit trail records
- Draft and maintain the Responsible AI Use Policy and supporting internal guidance
- Support ongoing ISO 42001 certification maintenance and internal audit readiness
- Monitor EU AI Act and US state-level AI legislation and assess applicability to Vasion's product and operations
- Provide operational support to the AI Governance Committee, coordinating with the CIO and cross-functional members
- Conduct AI vendor risk assessments in partnership with Security and Procurement
Policy Development & Training- Own the compliance policy library - drafting, maintaining, versioning, and publishing policies across domains
- Design and deliver privacy and AI governance training programs for internal teams
- Develop plain-language compliance guidance for Engineering, Marketing, Sales, and HR
- Support Sales with privacy and AI compliance questionnaire responses and Trust Center content
HIPAA Group Health Plan Support- Support Vasion's HIPAA obligations as a group health plan sponsor through the transition from level-funded to self-funded coverage
- Assist with Business Associate Agreement (BAA) management, workforce training coordination, and breach notification procedures
- Maintain HIPAA Privacy and Security Policies & Procedures in coordination with the CCO as Security Official
Qualifications- 3-5 years of experience in a privacy, compliance, or legal operations role - ideally at a technology or SaaS company
- Working knowledge of GDPR and CCPA and the practical mechanics of running a privacy program (not just regulatory familiarity)
- Experience reviewing, redlining, and negotiating Data Processing Agreements (DPAs)
- Exposure to AI governance frameworks, ISO 42001, or EU AI Act compliance is a meaningful plus
- Demonstrated ability to execute across multiple compliance workstreams simultaneously without losing detail or deadline discipline
- Strong written communication - you can write a policy people actually read and a training people actually learn from
- Comfort building in ambiguity - many of the processes you will own are in progress or not yet formalized
- CIPP/US, CIPP/E, or CIPM certification held or actively in progress preferred
- Experience with privacy GRC or consent management tools (OneTrust, MineOS, Osano, or similar) is a plus
- Familiarity with HIPAA group health plan compliance is a plus but not required
Benefits- Flexible work environment
- Vacation Bonus
- Flexible paid time off
- Paid parental leave
- Competitive pay
- A full suite of traditional benefits
- Training/Advancement opportunities
- 401k with company match and immediate vesting
- Financial wellness education
- Company-contributed HSA
- On-site perks include gym, pickleball, snacks & drinks, arcade, theater room, etc.
