[Remote] Senior Manager, Privacy Program

Note: The job is a remote job and is open to candidates in USA. Topstep is hiring a Senior Manager, Privacy Program to build and lead its enterprise-wide privacy and technical governance program. The role oversees a specialized team and integrates privacy operations, privacy-by-design practices, incident management, and automated IT governance and audit readiness.

Responsibilities

• People Management: Direct, mentor, and develop a high-performing team of privacy and technical governance professionals. Set clear OKRs, conduct performance reviews, and foster a culture of continuous operational improvement
• Function Integration: Seamlessly bridge the daily execution of privacy operations (DSARs, vendor reviews) with broader technical IT governance initiatives (automated control monitoring, audit readiness)
• SLA & Metric Management: Establish and monitor team KPIs, ensuring strict adherence to statutory timelines for privacy requests and maintaining real-time visibility into technical control health and framework alignment for executive reporting
• Program Strategy: Design, implement, and direct the comprehensive enterprise-wide privacy program, including developing the core governance framework, policies, standards, and procedures
• Data Classification & Mapping: Oversee the operationalization of a clear data classification system (Public, Internal, Confidential, Restricted). Direct the maintenance of Records of Processing Activities (RoPA) and continuous data flow mapping across the organization
• Privacy by Design (PbD): Serve as the strategic privacy advisor for Product Management and Engineering leadership. Ensure your team effectively embeds privacy-first design and development concepts into new products, services, and features before launch
• Training & Awareness: Direct the development and delivery of engaging, role-specific privacy and data security awareness campaigns across the firm
• DSAR & Queue Oversight: Oversee the end-to-end DSAR program (executed by your Privacy Operations Manager via tools like DataGrail). Ensure workflows for access, deletion, and correction requests scale efficiently and align with global legal expectations
• Privacy Incident Leadership: Act as the primary escalation point and incident commander for privacy incidents and data breaches. Partner with Security and Legal teams to drive investigation, containment, remediation, and regulatory notification
• Third-Party Risk Management: Oversee the vendor privacy risk assessment lifecycle. Ensure your team thoroughly evaluates Data Processing Agreements (DPAs) and vendor alignment with Topstep’s privacy standards
• IT GRC Roadmap: Oversee the execution of Topstep’s technical governance roadmap, ensuring engineering and product operations align with firm policies and external frameworks (SOC 2, ISO 27001, NIST)
• Continuous Assurance Automation: Champion the shift from manual, spreadsheet-heavy control tracking to automated, frictionless solutions. Direct your Technical Governance Manager in utilizing cloud-native GRC platforms (e.g., Vanta, Drata) for real-time evidence collection
• Policy Architecture Oversight: Ensure the centralization and operationalization of technical procedures, review attestation, and exception tracking across engineering partners

Skills

• 8 + years of progressive experience in privacy, data protection, or IT Governance & Risk programs within regulated environments (Fintech, Financial Services, or SaaS)
• 3 + years of direct people management experience, with a proven track record of hiring, mentoring, and scaling governance, risk, or privacy teams
• Deep working knowledge of major global privacy regulations (e.g., GDPR, CCPA/CPRA) combined with a strong understanding of core security and control frameworks (e.g., SOC 2 Type II, ISO 27001, NIST CSF)
• Familiarity with modern privacy automation software (e.g., DataGrail, OneTrust, Transcend) as well as cloud-native governance and risk platforms (e.g., Vanta, Drata, LogicGate)
• Engineering literacy necessary to oversee technical governance roadmaps; ability to understand development pipelines, cloud architecture, and access controls to effectively bridge the gap between Legal/Risk partners and Product/Engineering
• Demonstrated experience moving assurance and control functions from reactive, manual processes to proactive, automated, and metrics-driven operations
• Exceptional ability to translate complex legal and technical requirements into practical business guidance for non-experts, with strong executive presence to report up to the C-suite

Benefits

• Fully remote to hybrid work arrangement
• Seven Company-paid Holidays
• Generous Family Leave
• Paid time off is front-loaded
• Competitive 401(k) matching
• Health, dental, and vision insurance for full-time employees
• A bonus for taking 5 consecutive days of vacation
• Food and groceries budget
• Contributions towards health and wellness
• Performance-based bonus

Company Overview