Our client, a rapidly growing, PE-backed performance marketing firm, is seeking a Senior Manager of Data Privacy & Security Compliance to take full ownership of its privacy and compliance program. This is a highly visible, hands-on opportunity with the ability to build and shape the program from the ground up rather than maintain an established function. The ideal candidate will bring strong AdTech/MarTech or lead-generation experience, deep knowledge of TCPA, DNC, and evolving data privacy regulations, and the ability to drive everything from compliance strategy and tooling decisions to day-to-day execution and audit readiness. The company offers a collaborative, down-to-earth leadership team, excellent work-life balance, and the opportunity to make a meaningful impact on a growing business. This is a fully remote opportunity, with a preference for candidates in the Eastern or Central time zones.
Key Responsibilities
- Lead day-to-day privacy and regulatory compliance activities, ensuring business practices align with applicable federal and state requirements governing consumer information, data brokerage, and marketing communications.
- Manage consumer privacy rights processes, including high-volume access, deletion, and opt-out requests, ensuring compliance with applicable statutory deadlines, including 45-day response requirements.
- Oversee data governance practices, including maintaining Records of Processing Activities (RoPA), updating data inventories, and documenting the movement and use of personally identifiable information throughout its lifecycle.
- Work closely with engineering and development teams to improve automated privacy workflows, including consumer preference management and the communication of opt-out instructions to downstream data recipients.
- Maintain oversight of website tracking technologies, including cookies, pixels, SDKs, and related tools, ensuring accurate documentation of their functionality, data collection practices, and associated disclosures.
- Evaluate existing consent management processes to confirm that website tracking activities, consent mechanisms, and privacy notices remain consistent with applicable requirements and published policies.
- Administer TCPA compliance procedures, including internal and national Do Not Call screening, Reassigned Numbers Database checks, consent documentation and retention, and timely processing of consumer revocations.
- Monitor evolving federal and state telemarketing requirements, including state-specific consent obligations, calling restrictions, and Do Not Call regulations.
- Conduct due diligence on third-party data sources, vendor relationships, APIs, and SDKs to assess data provenance, consumer consent, and compliance with applicable privacy obligations.
- Coordinate Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) when evaluating new data offerings or alternative data sources.
- Maintain required data broker and corporate registrations with relevant state authorities, including California, Texas, Vermont, Oregon, and other applicable jurisdictions.
- Administer operational compliance with California's Data Removal and Opt-Out Platform (DROP), including required 45-day data retrieval and update cycles.
- Coordinate independent compliance reviews, security audits, and technical risk assessments, including preparation for the initial state-required assessment scheduled for early 2028.
- Collaborate with information security and engineering teams to maintain appropriate safeguards and support alignment with applicable state data broker security requirements.
- Support incident response planning and execution, including breach containment, documentation, and coordination of applicable state regulatory notifications.
- Identify regulatory developments and potential compliance gaps, recommending practical improvements to privacy processes, technical controls, and operational procedures.
- Demonstrated experience overseeing privacy, data governance, or regulatory compliance operations.
- Professional experience within AdTech, MarTech, data brokerage, or lead-generation environments.
- Advanced knowledge of U.S. privacy regulations, including CCPA/CPRA, California's Delete Act (SB 362), the Defending Californians Data Act (SB 361), state data broker registration requirements, and comprehensive state privacy legislation.
- Strong understanding of TCPA requirements, related FCC enforcement priorities, and state-specific telemarketing and consent regulations.
- Familiarity with privacy-related litigation risks involving the California Invasion of Privacy Act (CIPA), Electronic Communications Privacy Act (ECPA), Video Privacy Protection Act (VPPA), Washington's My Health My Data Act, and California's Unfair Competition Law.
- Working knowledge of information security and privacy frameworks, including ISO 27001, ISO 27701, NIST, and SOC 2, with the ability to relate technical controls to compliance obligations.
- Understanding of digital advertising and tracking technologies, including cookies, device fingerprinting, and mobile advertising identifiers (MAIDs).
- Ability to collaborate effectively with technical stakeholders and engineering leadership on privacy controls, data handling practices, and compliance-related initiatives.
- Bachelor's degree in Business Management, Accounting, Technology Management, or a related discipline.
- Current CIPP/US, CIPM, CIPT, or CISSP certification.
- Juris Doctor (JD) or educational background emphasizing legal studies.
- Demonstrated experience establishing or building privacy or information security programs, rather than solely maintaining established programs.