Sezzle - Privacy Manager
Requirements
• CIPM (privacy program management) plus CIPP/US or CIPP/C; CIPT is a plus. • Technical familiarity with modern privacy tech platforms (e.g., OneTrust, Securiti.ai, WireWheel) and data infrastructure analytics. • Experience navigating financial regulations and compliance frameworks (e.g., GLBA, PCI-DSS) alongside traditional consumer privacy laws. • Public-company experience, including supporting audit committee or board-level reporting. • You have relentlessly high standards - many people may think your standards are unreasonably high. You are continually raising the bar and driving those around you to deliver great results. You make sure that defects do not get sent down the line and that problems are fixed so they stay fixed. • You’re not bound by convention - your success, and much of the fun, lies in developing new ways to do things. • You’re not bound by convention • You need action - speed matters in business. Many decisions and actions are reversible and do not need extensive study. We value calculated risk-taking. • You need action • You earn trust - you listen attentively, speak candidly, and treat others respectfully. • You earn trust • You have backbone; disagree, then commit - you can respectfully challenge decisions when you disagree, even when doing so is uncomfortable or exhausting. You have conviction and are tenacious. You do not compromise for the sake of social cohesion. Once a decision is determined, you commit wholly. • You have backbone; disagree, then commit • You deliver results - you focus on the key inputs and deliver them with the right quality and in a timely fashion. Despite setbacks, you rise to the occasion and never settle. • You deliver results • What Makes Working at Sezzle Awesome: • At Sezzle, we are more than just brilliant engineers, passionate data enthusiasts, out-of-the-box thinkers, and determined innovators. We believe in surrounding ourselves with only the best and the brightest individuals. Our culture is not defined by a certain set of perks designed to give the illusion of the traditional startup culture, but rather, it is the visible example living in every employee that we hire.
Responsibilities
• Build the program: Drive Sezzle’s implementation of the NIST Privacy Framework from roadmap to operating program, including Current and Target Profiles, gap analysis, a prioritized and costed action plan, and ongoing monitoring, aligned with US state and federal requirements (CCPA/CPRA and other state comprehensive privacy laws, GLBA, TCPA) and Canadian privacy laws (PIPEDA and Quebec’s Law 25). • Build the program: • Run privacy review: Own privacy risk assessments and Privacy Impact Assessments (PIAs) for new products, features, and third-party vendors, and operate an intake and disposition process that gives every proposal a fast, documented answer: approved, approved with controls, or needs redesign. • Run privacy review: • Own the data map and consumer rights: Build and maintain the enterprise data inventory and data map in partnership with Engineering, tracking the lifecycle of consumer information, and manage the automation and fulfillment of consumer access, deletion, and opt-out requests. • Own the data map and consumer rights: • Operationalize privacy-enhancing techniques: Administer Sezzle’s de-identification and aggregation standard and its approval workflow so that data-driven products and analytics ship with the right controls designed in from the start. • Operationalize privacy-enhancing techniques: • Embed privacy-by-design: Partner directly with Engineering, Product, and Marketing teams during early-stage development so that privacy requirements are designed in, not bolted on. • Embed privacy-by-design: • Govern, measure, and report: Run the cadence of Sezzle’s cross-functional privacy working group, maintain the program’s decision log and obligations register, track program metrics, and support executive and board-level reporting. Collaborate closely with the Information Security team to manage, investigate, and mitigate privacy incidents and cross-border data transfer risks. • Govern, measure, and report: • What We Look For: • Proven Builder: 4+ years of dedicated experience managing data privacy programs, including at least one program or major program component (a data inventory, a consumer rights operation, a privacy review process) that you stood up from early stage to steady state rather than inherited. High-growth fintech, e-commerce, or SaaS experience operating in both the US and Canada is ideal. • Proven Builder: • Framework Fluency: Hands-on experience implementing a recognized privacy or security framework (NIST Privacy Framework strongly preferred; NIST CSF or ISO 27701 also relevant), including profiles or maturity assessments, gap analyses, and action plans. • Framework Fluency: • Deep Regulatory Knowledge: Strong working knowledge of major North American privacy frameworks (CCPA/CPRA and the broader US state privacy law landscape, TCPA, GLBA, PIPEDA, Quebec Law 25) and a sharp knack for translating complex legal mandates into clear, actionable business processes. • Deep Regulatory Knowledge: • Product-Enablement Mindset: You treat privacy as the path to yes. You are fluent in de-identification, aggregation, and other privacy-enhancing techniques as tools that let data products launch responsibly, and you can defend the line between what is de-identified and what is not. • Product-Enablement Mindset: • Cross-Functional Communication: High emotional intelligence (EQ) with the ability to influence technical and non-technical stakeholders alike, run a cross-functional working group, and present clearly to executives. • Cross-Functional Communication: • Problem-Solving Ownership: A self-starter mindset with the ability to manage multiple high-stakes projects simultaneously in an environment where speed and agility matter. • Problem-Solving Ownership:
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT