Privacy and Compliance Specialist

Overview

This role involves owning day-to-day privacy operations, managing cross-functional compliance projects, and serving as a primary point of contact for privacy-related customer and partner inquiries. You will work closely with Legal, Engineering, Product, Security, and Commercial teams to maintain and strengthen the organization’s privacy posture as it scales.

Responsibilities

Privacy Program Operations

• With supervision from the Sr. Corporate Counsel and Privacy Officer, manage and maintain the privacy compliance program, including policies, procedures, and documentation.
• Conduct and coordinate privacy impact assessments (PIAs/DPIAs) and data protection assessments for new products, features, and vendor relationships.
• Maintain records of processing activities (RoPA), data inventories, and data flow maps.
• Monitor and operationalize requirements under HIPAA, state privacy laws (CCPA/CPRA and other state comprehensive privacy laws), and other applicable frameworks.
• Implement and support Privacy by Design across all aspects of the business.
• Support data subject rights requests (DSARs) and privacy incident response workflows.

Customer and Partner Privacy Support

• Serve as a primary point of contact for privacy and data-related inquiries from customers, prospects, and partners.
• Draft and maintain responses to privacy questionnaires, RFPs, security assessments, and due diligence requests.
• Support the negotiation and review of Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs).

Project Management and Cross-Functional Coordination

• Drive privacy and compliance initiatives from planning through execution, managing timelines, stakeholders, and deliverables.
• Develop and deliver privacy training and awareness programs across the organization.
• Build and maintain privacy metrics, dashboards, and reporting for leadership and Board visibility.
• Identify opportunities to improve and automate privacy processes and workflows.

90-Day Plan

• Get up to speed on the privacy program, existing policies, data flows, and key stakeholders across Legal, Engineering, Product, Security, and Commercial.
• Take ownership of the privacy impact assessment process and complete at least one PIA/DPIA for a current initiative.
• Manage incoming privacy questionnaires, RFPs, and customer/partner privacy inquiries, establishing repeatable response workflows.
• Review existing DSAR and privacy incident response workflows and identify concrete improvement opportunities.
• Begin building privacy metrics and reporting to provide leadership with visibility into program performance and risk posture.

Requirements (Must-Haves)

• 4 to 7 years of experience in privacy, compliance, data protection, or a related field.
• Working knowledge of HIPAA, state consumer privacy laws (including CCPA/CPRA), and health data regulations.
• Demonstrated project management skills with the ability to manage multiple workstreams simultaneously.
• Experience with privacy impact assessments, incident response, or data subject request (DSAR) workflows.
• Strong written and verbal communication skills, with the ability to translate complex privacy requirements into practical guidance.
• Demonstrates a proactive use of AI tools to improve individual output and efficiency.

Preferred Qualifications

No additional preferred qualifications were specified.

Compensation & Benefits

• Compensation range: $100,000 to $120,000 (starting pay based on a number of factors and commensurate with qualifications & experience).
• Benefits information is available via the organization’s Careers page.

Location

• Remote-first; team is spread across various locations with office hubs in Denver and San Francisco.
• Clinical roles: We currently do not hire in the following states: AK, HI, RI.
• Corporate roles: We currently do not hire in the following states: AK, AR, DE, HI, ME, MS, NM, OK, SD, VT, WI.

Privacy & Security Note

You may come in contact with sensitive patient information governed by HIPAA. Throughout employment, follow security and privacy procedures to keep patient information strictly confidential. Security and privacy training will be provided.