Privacy Program Manager - Remote

The Opportunity

The Privacy Program Manager will be responsible for establishing and maintaining all aspects of an enterprise-wide privacy program framework at the department, business, and functional area levels. The individual will work as part of the regulatory compliance and privacy team and be responsible for establishing and maintaining enterprise-wide related privacy policies/procedures, privacy impact assessments/risk assessments, metrics, enterprise-wide privacy training, and ensuring compliance with applicable privacy requirements. The individual must have good knowledge of privacy/data protection laws and the ability to interpret privacy legislation, laws/regulations, and advise the VELERA business and functional areas on how to bring the company into compliance with complex privacy-related legal, regulatory, and/or policy requirements. They work with leadership, including senior management, and are accountable for identifying key collaborators and advising on privacy-related legal/compliance requirements. This individual is part of the second line of defense on the privacy and/or regulatory compliance team and participates in council meetings. The successful individual will have credibility and be able to influence privacy matters. They have strong written and verbal communication skills to communicate with all leadership levels within the organization, as well as the ability to establish collaborative relationships within the company.

Day in the Life

• Develops, improves, and promotes the privacy framework, in conjunction with the vision of direct leadership, and directs and coordinates the privacy program, including associated risk to the organization.

• Provides thought leadership, advice, and recommendations to managers and leadership.

• Provides strategic guidance and supports the business, functional, and compliance teams to assess, develop, and implement enhanced privacy controls and processes to support program implementation, oversight, and monitoring.

• Provides input to design and maintains ongoing privacy training to enhance enterprise-wide privacy risk management knowledge and culture.

• Develops insight and maintains transparency around privacy risk for managers, leadership, committees, and senior management on the performance of privacy program/activities within the organization.

• Acts as a primary point of contact within the organization for members of staff and regulators on issues related to privacy.

• Promotes a culture of privacy compliance across the organization through Policy, Process, and/or Procedures; provides guidance to resolve privacy issues brought up from business and functional areas representatives.

• Maintains, writes, and updates policies to ensure continued alignment with privacy laws and regulations in the jurisdictions in which VELERA transacts or operates, as applicable. Examples may include, but are not limited to, privacy-related laws in U.S. states or territories, the General Data Protection Regulation (GDPR), Canada PIPEDA, Bermuda PIPA, and the California Consumer Protection Act.

• Monitor changes to privacy laws and regulations, and make recommendations to the business and functional areas, as appropriate. Maintain an awareness of industry best practices in order to ensure an effective and dynamic privacy framework.

• Monitor operational privacy practices to assess adherence to corporate policy requirements and provide assurance that relevant privacy processes are effectively embedded into the business.

• Perform Privacy Impact Assessments (‘PIAs’) to ensure that all relevant privacy changes are captured and assessed in a timely fashion.

• Manage the Data Subject Access Request (DSAR) process, including reviewing, validating, and responding to requests and maintaining a repository of requests and responses.

• Provide regulatory input to data incident management as needed, working closely with Legal, Investigations & Corporate Fraud, IT, and InfoSec teams to ensure appropriate and timely resolution.

• Review vendor contracts in partnership with the firm’s Legal, Vendor Risk Management, Procurement, Compliance, and Information Security functions, to ensure inclusion of appropriate privacy-related contractual clauses.

• Participate in the relevant compliance and/or data governance councils and/or committees, and provide input to leadership and/or other group councils, as required.

• Report on data privacy matters to leadership and key collaborators, appropriately escalating any privacy risks as required.

• Exhibit indirect leadership and influence to ensure that people, resources, and processes are aligned with VELERA’s privacy framework and deliver the required standards of performance.

• Perform other duties as assigned.

Qualifications:

• Bachelor’s degree in Business Administration, Finance, Accounting, or related disciplines required; preferably in legal, regulatory, or financial services compliance.

• Certified Information Privacy Professional (CIPP) or other Data Protection certification desired

• Seven (7) years of related work experience in the 2nd or 3rd line of defense, preferably in the 2nd line working in a financial services environment in functional areas such as compliance, risk management, information security, or audit required. 

• Seven (7) years of experience working in privacy, including expertise with privacy framework design/implementation, managing and advising on complex projects, and preparing deliverables for all levels of leadership of the organization required.