About the Role
As our data, systems, and partner relationships grow, we're in need of a
Privacy & Data Governance Director to strengthen and run our privacy and data governance program.
This person will turn written policy into enhanced controls that actually operate across our platforms, including Salesforce, AWS, and other collaboration tools. They'll set the rules for how we classify, retain, anonymize, and delete data. They'll also set guardrails for new data risks, including AI tools. The role will work closely with Legal, Risk, Operations, Engineering, and IT/Security.
Responsibilities- Own the data classification policy and establish governance over the inventory of confidential and restricted data across systems, vendors, and data flows.
- Maintain privacy policies, procedures, and standards that match applicable law, partner requirements, and our own risk appetite.
- Run privacy impact assessments for new products, systems, vendors, and major changes.
- Support successful completion of SOC 2 audits.
- Assist with third-party reviews to ensure proper alignment with privacy and data governance requirements.
- Lead the retention program, including retention schedules, legal holds, and secure disposal and media sanitization.
- Partner with Engineering to specify retention and deletion controls inside production systems, and confirm they work as designed.
- Write and maintain governance standards for generative AI tools, covering acceptable use, what data may go into prompts, and vendor review.
- Help set requirements for data loss prevention (DLP) and data discovery tools.
- Test privacy and data controls in key systems.
- Track gaps and remediation and report status and risk trends to senior leadership.
- Serve as the privacy point of contact for audits, bank partner reviews, and regulatory exams.
- Assist in building privacy and data-handling training for employees and new hires.
Requirements- 7+ years in privacy, data governance, information security compliance, or a related field. At least 3 years should be in financial services, fintech, or another regulated industry.
- US CIPP (Certified Information Privacy Professional) and/or CRCM (Certified Regulatory Compliance Manager) certification preferred.
- Hands-on experience building or significantly enhancing a privacy or data governance program, including data classification, data inventories, and retention schedules.
- Core knowledge and applicable experience with U.S. privacy and record-retention requirements relevant to lending. Examples include CCPA/CPRA, GLBA, ECOA/Reg B record retention, BSA/AML recordkeeping, and state data-breach laws.
- Understanding of de-identification, pseudonymization, and deletion methods, and the legal and technical tradeoffs among them.
- Experience testing controls or supporting audits (SOC 2, internal audit, or regulatory exams).
- Comfort working with technical teams: reading system configurations, writing clear requirements, and following remediation through ticketing tools such as Jira.
- Excellent written communication.
Benefits- Competitive salary
- Health insurance
- Growth and development opportunities
- Dynamic and collaborative work environment
- Company events and team-building activities
