Director of Privacy and Data Governance Risk

The Team

As the Director of Privacy and Data Governance at Upstart, you will play a pivotal role in ensuring the responsible use of data across the organization. You will lead the development and execution of a comprehensive Privacy and Data Governance Risk Management Program (“the Program”) that supports Upstart’s mission while aligning with regulatory expectations and industry best practices. This role requires strong cross-functional leadership, strategic thinking, and a deep understanding of privacy frameworks, regulatory requirements, and data governance principles. You will work closely with teams across Legal, Product, Data Platform, and Information Security to identify, assess, and mitigate privacy and data governance risks across Upstart’s products and services.

Position Location - This role is available in the following locations: Remote, San Mateo, CA, and Columbus, OH

Time Zone Requirements - This team operates on the East/West Coast time zones.

Travel Requirements - As a digital first company, the majority of your work can be accomplished remotely. The majority of our employees can live and work anywhere in the U.S but are encouraged to to still spend high quality time in-person collaborating via regular onsites. The in-person sessions’ cadence varies depending on the team and role; the Risk & Compliance team meets quarterly for 3-4 consecutive days at a time.

How you’ll make an impact:

• Define and drive the strategy for privacy and data governance risk management aligned with Upstart’s business objectives and regulatory obligations.
• Oversee the development of policies, procedures, and processes for data lifecycle management and privacy-by-design.
• Serve as a strategic partner to Product, Data Platform, Information Security and other teams to embed privacy and data governance into product design, business operations, and third-party relationships.
• Lead cross-functional working group to ensure governance, accountability, and continuous improvement in privacy risk management.
• Lead a team responsible for the execution of privacy and data governance initiatives.
• Set team objectives and key results (OKRs), manage performance, and allocate resources effectively to deliver measurable impact.
• Act as a spokesperson and subject matter expert for the Program in engagements with internal stakeholders and Upstart’s partners.
• Prepare and deliver communications, reports, and updates to senior leadership

What we’re looking for:

• Minimum requirements:
• 10+ years of experience in compliance, legal, audit, or risk management within the financial services or fintech industry, with deep expertise in consumer protection regulations. This includes working knowledge of key regulatory frameworks such as GLBA, CCPA, FCRA, UDAAP, federal and state privacy laws, and emerging AI regulations.
• 3–5 years of risk or compliance governance experience at a financial institution, with demonstrated success in scaling frameworks and driving cross-functional alignment.
• Proven ability to lead enterprise-wide risk and compliance programs, influence across levels and functions, and manage complex stakeholder environments.
• Hands-on experience in operationalizing risk management programs, including risk identification, control design, testing and monitoring, training and enablement, and oversight of third-party relationships.
• Preferred qualifications:
• Familiarity with modern predictive modeling techniques and the associated governance, privacy, and fairness considerations.
• Strong people leadership experience, with a track record of building, managing, and developing high-performing teams.
• Exceptional communication, negotiation, and presentation skills, with the ability to translate complex risk issues into clear, actionable guidance for both technical and non-technical audiences.
• Current and active certification in Privacy or Information Security (CISA, CISM, CISSP, CIPP, CIPM)