Chief Privacy Officer
IDEXX · Westbrook, ME · 4 wk ago
Full-time
We need to output HTML fragment with headings for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. No Job ID etc. Remove boilerplate like EEO statement, legal, etc. Also remove application instructions (none present). Keep substantive info.
We need to parse the posting.
Content:
- Intro paragraph describing role: "The Chief Privacy Officer (CPO) is IDEXX's enterprise leader for global personal data privacy strategy and execution, and a key partner on cybersecurity and AI governance risk. The CPO builds and runs IDEXX's Privacy Center of Excellence, ensuring compliance with applicable data protection laws worldwide. In addition, the role provides legal and compliance guidance in furtherance of cybersecurity and AI governance maturity. The role will sit at the epicenter of the legal convergence of these fast-moving and complex areas. The role partners closely with Legal, Compliance, IT, Information Security, Product Development, Marketing, HR, Commercial Operations, and Executive Leadership to adapt the privacy framework to business needs while managing risk. The CPO may also serve as, or oversee, IDEXX's Global Data Protection Officer functions where required by applicable law and helps build the policies and processes needed to support compliance with applicable global cybersecurity and AI regulations."
That's about the role.
Then "Key Responsibilities" with subheadings: Enterprise Privacy Leadership and Cybersecurity and AI Governance Partnership. Under each bullet list.
We need to extract responsibilities as list items.
Enterprise Privacy Leadership bullet points:
- Develop and execute IDEXX's global privacy strategy and operating model.
- Monitor emerging privacy laws, regulatory guidance, and enforcement trends worldwide.
- Lead the design and maintenance of global privacy policies, standards, procedures, and controls.
- Oversee privacy impact assessments, data protection impact assessments, cross-border transfer assessments, and privacy-by-design processes.
- Serve as executive sponsor of the Global Privacy Steering Committee.
- Drive privacy risk identification, mitigation, reporting, and governance across all business functions.
- Advise executive leadership on strategic privacy risks affecting growth, innovation, and customer trust.
- Establish multi-year strategic roadmaps supporting organizational growth and digital transformation.
- Represent IDEXX with regulators, industry groups, customers, partners, and external stakeholders.
Cybersecurity and AI Governance Partnership bullet points:
- Partner with the Chief Information Security Officer to build an integrated privacy and cybersecurity governance framework.
- Advise on cyber-related regulatory obligations, including breach notification and incident-reporting duties under the EU Cyber Resilience Act, in partnership with the Chief Corporate and Securities Counsel (U.S. securities disclosure) and Chief Commercial Counsel (contractual disclosure obligations).
- Support enterprise cybersecurity and AI incident response, crisis management, and post-incident remediation.
- Serve as first point of legal contact for enterprise-wide AI governance policy guidance, advising leadership on the legal, ethical, and regulatory implications of AI/ML systems.
- Monitor emerging cybersecurity and AI regulatory frameworks (including the EU Cyber Resilience Act and EU AI Act) and drive required compliance activity.
- Serve on relevant governance committees and cross-functional review boards.
- Drive alignment between privacy, cybersecurity, AI, and broader enterprise risk management programs, including data management.
Then "Qualifications" with subheadings: Education, Experience Needed, Success Profile, What Success Looks Like? Actually "Qualifications" includes Education, Experience Needed, Success Profile, What Success Looks Like? The posting includes:
Qualifications
Education
JD, LLM, Master's degree, or equivalent advanced degree preferred.
Relevant certification desirable: CIPP/E, CIPP/US, CIPM, or CIPT.
Experience Needed
10+ years of progressive experience in privacy, compliance, legal, cybersecurity, or AI/ML governance.
Experience leading global privacy programs at a multinational organization.
Demonstrated experience partnering with a CISO on personal data breach response.
Experience with AI governance and emerging AI regulatory requirements.
Experience operating across complex global regulatory regimes: GDPR, UK GDPR, CCPA/CPRA, LGPD, APAC privacy laws, and emerging AI regulation.
Proven ability to influence executive leadership and cross-functional stakeholders.
Success Profile
Sound, courageous judgment under regulatory ambiguity - much of AI governance law is still unsettled.
Executive presence and the ability to influence without direct authority across Legal, IT, Security, and the business.
Intellectual rigor paired with humility and genuine cross-functional collaboration.
What Success Looks Like
Elevates IDEXX's privacy program into a fully integrated privacy, cybersecurity, and AI governance model.
Builds scalable governance processes that enable global growth while protecting customers, employees, and other stakeholders.
Positions IDEXX as a trusted steward of personal data.
Then "Why IDEXX" paragraph about purpose, benefits, etc. Also includes "At IDEXX, you’ll be supported by competitive compensation, incentives, and benefits while enjoying purposeful work that drives improvement." This mentions compensation and benefits but not specific details. We should not create Benefits/Pay/Schedule sections unless posting actually states them. It says "competitive compensation, incentives, and benefits" but no specifics. According to rule: never create Pay/Schedule/Benefits sections unless the posting actually states them. It does state "competitive compensation, incentives, and benefits" but that's vague. The rule says: never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. The phrase "competitive compensation, incentives, and benefits" is somewhat vague but still states that there are benefits and compensation. However it's not specific details. The instruction: "never create Pay/Schedule/Benefits sections unless the posting actually states them." It does state them in a generic sense. Should we include a Benefits section with that statement? It might be considered filler? The rule says avoid filler like "commensurate with experience", "not specified", etc. "competitive compensation, incentives, and benefits" is not exactly filler but still vague. However we could include a Benefits section with that sentence. But we also have a "Why IDEXX" paragraph that includes that. Could we put that under About the role? Probably better to keep "Why IDEXX" as part of About the role or maybe a separate section like "About IDEXX". But we only allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We could put the Why IDEXX paragraph under About the role (makes sense). Or we could create a Benefits section with the statement about competitive compensation, incentives, and benefits. But we also need to avoid creating sections with filler. The phrase is not filler but it's still generic. I'd lean to include a Benefits section with that statement, as it's actual content about benefits/compensation. However we also have no specific Pay or Schedule details, so we should not create Pay or Schedule sections.
We also have Skills? Not explicitly listed; maybe we could infer from qualifications but better not to create Skills unless explicit. The posting does not have a separate Skills section. So we omit Skills.
Requirements? The posting has Qualifications (Education, Experience Needed). Could treat Requirements as Qualifications? The headings list includes Requirements and Qualifications separate. We could put Education and Experience Needed under Requirements, and maybe Certifications under Qualifications? But we need to follow instruction: use headings only when posting has real, specific content for it. We have content for Education, Experience Needed, Success Profile, What Success Looks Like. Could combine into Qualifications section. Or we could have Requirements (Experience Needed) and Qualifications (Education, Certifications, Success Profile). However the instruction says prefer a few substantive sections over many thin ones. So maybe we combine Education, Experience Needed, Success Profile, What Success Looks Like into a single Qualifications section. Or we could have About the role, Responsibilities, Qualifications (covering education, experience, success profile), Benefits (compensation/benefits). That seems reasonable.
We must not repeat job title as heading. So no
for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. No Job ID etc. Remove boilerplate like EEO statement, legal, etc. Also remove application instructions (none present). Keep substantive info.
We need to parse the posting.
Content:
- Intro paragraph describing role: "The Chief Privacy Officer (CPO) is IDEXX's enterprise leader for global personal data privacy strategy and execution, and a key partner on cybersecurity and AI governance risk. The CPO builds and runs IDEXX's Privacy Center of Excellence, ensuring compliance with applicable data protection laws worldwide. In addition, the role provides legal and compliance guidance in furtherance of cybersecurity and AI governance maturity. The role will sit at the epicenter of the legal convergence of these fast-moving and complex areas. The role partners closely with Legal, Compliance, IT, Information Security, Product Development, Marketing, HR, Commercial Operations, and Executive Leadership to adapt the privacy framework to business needs while managing risk. The CPO may also serve as, or oversee, IDEXX's Global Data Protection Officer functions where required by applicable law and helps build the policies and processes needed to support compliance with applicable global cybersecurity and AI regulations."
That's about the role.
Then "Key Responsibilities" with subheadings: Enterprise Privacy Leadership and Cybersecurity and AI Governance Partnership. Under each bullet list.
We need to extract responsibilities as list items.
Enterprise Privacy Leadership bullet points:
- Develop and execute IDEXX's global privacy strategy and operating model.
- Monitor emerging privacy laws, regulatory guidance, and enforcement trends worldwide.
- Lead the design and maintenance of global privacy policies, standards, procedures, and controls.
- Oversee privacy impact assessments, data protection impact assessments, cross-border transfer assessments, and privacy-by-design processes.
- Serve as executive sponsor of the Global Privacy Steering Committee.
- Drive privacy risk identification, mitigation, reporting, and governance across all business functions.
- Advise executive leadership on strategic privacy risks affecting growth, innovation, and customer trust.
- Establish multi-year strategic roadmaps supporting organizational growth and digital transformation.
- Represent IDEXX with regulators, industry groups, customers, partners, and external stakeholders.
Cybersecurity and AI Governance Partnership bullet points:
- Partner with the Chief Information Security Officer to build an integrated privacy and cybersecurity governance framework.
- Advise on cyber-related regulatory obligations, including breach notification and incident-reporting duties under the EU Cyber Resilience Act, in partnership with the Chief Corporate and Securities Counsel (U.S. securities disclosure) and Chief Commercial Counsel (contractual disclosure obligations).
- Support enterprise cybersecurity and AI incident response, crisis management, and post-incident remediation.
- Serve as first point of legal contact for enterprise-wide AI governance policy guidance, advising leadership on the legal, ethical, and regulatory implications of AI/ML systems.
- Monitor emerging cybersecurity and AI regulatory frameworks (including the EU Cyber Resilience Act and EU AI Act) and drive required compliance activity.
- Serve on relevant governance committees and cross-functional review boards.
- Drive alignment between privacy, cybersecurity, AI, and broader enterprise risk management programs, including data management.
Then "Qualifications" with subheadings: Education, Experience Needed, Success Profile, What Success Looks Like? Actually "Qualifications" includes Education, Experience Needed, Success Profile, What Success Looks Like? The posting includes:
Qualifications
Education
JD, LLM, Master's degree, or equivalent advanced degree preferred.
Relevant certification desirable: CIPP/E, CIPP/US, CIPM, or CIPT.
Experience Needed
10+ years of progressive experience in privacy, compliance, legal, cybersecurity, or AI/ML governance.
Experience leading global privacy programs at a multinational organization.
Demonstrated experience partnering with a CISO on personal data breach response.
Experience with AI governance and emerging AI regulatory requirements.
Experience operating across complex global regulatory regimes: GDPR, UK GDPR, CCPA/CPRA, LGPD, APAC privacy laws, and emerging AI regulation.
Proven ability to influence executive leadership and cross-functional stakeholders.
Success Profile
Sound, courageous judgment under regulatory ambiguity - much of AI governance law is still unsettled.
Executive presence and the ability to influence without direct authority across Legal, IT, Security, and the business.
Intellectual rigor paired with humility and genuine cross-functional collaboration.
What Success Looks Like
Elevates IDEXX's privacy program into a fully integrated privacy, cybersecurity, and AI governance model.
Builds scalable governance processes that enable global growth while protecting customers, employees, and other stakeholders.
Positions IDEXX as a trusted steward of personal data.
Then "Why IDEXX" paragraph about purpose, benefits, etc. Also includes "At IDEXX, you’ll be supported by competitive compensation, incentives, and benefits while enjoying purposeful work that drives improvement." This mentions compensation and benefits but not specific details. We should not create Benefits/Pay/Schedule sections unless posting actually states them. It says "competitive compensation, incentives, and benefits" but no specifics. According to rule: never create Pay/Schedule/Benefits sections unless the posting actually states them. It does state "competitive compensation, incentives, and benefits" but that's vague. The rule says: never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. The phrase "competitive compensation, incentives, and benefits" is somewhat vague but still states that there are benefits and compensation. However it's not specific details. The instruction: "never create Pay/Schedule/Benefits sections unless the posting actually states them." It does state them in a generic sense. Should we include a Benefits section with that statement? It might be considered filler? The rule says avoid filler like "commensurate with experience", "not specified", etc. "competitive compensation, incentives, and benefits" is not exactly filler but still vague. However we could include a Benefits section with that sentence. But we also have a "Why IDEXX" paragraph that includes that. Could we put that under About the role? Probably better to keep "Why IDEXX" as part of About the role or maybe a separate section like "About IDEXX". But we only allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We could put the Why IDEXX paragraph under About the role (makes sense). Or we could create a Benefits section with the statement about competitive compensation, incentives, and benefits. But we also need to avoid creating sections with filler. The phrase is not filler but it's still generic. I'd lean to include a Benefits section with that statement, as it's actual content about benefits/compensation. However we also have no specific Pay or Schedule details, so we should not create Pay or Schedule sections.
We also have Skills? Not explicitly listed; maybe we could infer from qualifications but better not to create Skills unless explicit. The posting does not have a separate Skills section. So we omit Skills.
Requirements? The posting has Qualifications (Education, Experience Needed). Could treat Requirements as Qualifications? The headings list includes Requirements and Qualifications separate. We could put Education and Experience Needed under Requirements, and maybe Certifications under Qualifications? But we need to follow instruction: use headings only when posting has real, specific content for it. We have content for Education, Experience Needed, Success Profile, What Success Looks Like. Could combine into Qualifications section. Or we could have Requirements (Experience Needed) and Qualifications (Education, Certifications, Success Profile). However the instruction says prefer a few substantive sections over many thin ones. So maybe we combine Education, Experience Needed, Success Profile, What Success Looks Like into a single Qualifications section. Or we could have About the role, Responsibilities, Qualifications (covering education, experience, success profile), Benefits (compensation/benefits). That seems reasonable.
We must not repeat job title as heading. So no Chief Privacy Officer
.
We need to output only HTML fragment.
Let's craft:
About the role
... intro paragraph ... plus Why IDEXX paragraph? We'll include the Why IDEXX paragraph there.
Responsibilities
- ... each bullet ...
Qualifications
We need to include Education, Experience Needed, Success Profile, What Success Looks Like. Could format asfor each subsection or combine into
- ? Probably better to use
- JD, LLM, Master's degree, or equivalent advanced degree preferred.
- Relevant certification desirable: CIPP/E, CIPP/US, CIPM, or CIPT.
- 10+ years of progressive experience in privacy, compliance, legal, cybersecurity, or AI/ML governance.
- Experience leading global privacy programs at a multinational organization.
- Demonstrated experience partnering with a CISO on personal data breach response.
- Experience with AI governance and emerging AI regulatory requirements.
- Experience operating across complex global regulatory regimes: GDPR, UK GDPR, CCPA/CPRA, LGPD, APAC privacy laws, and emerging AI regulation.
- Proven ability to influence executive leadership and cross-functional stakeholders.
- Sound, courageous judgment under regulatory ambiguity - much of AI governance law is still unsettled.
- Executive presence and the ability to influence without direct authority across Legal, IT, Security, and the business.
- Intellectual rigor paired with humility and genuine cross-functional collaboration.
- Elevates IDEXX's privacy program into a fully integrated privacy, cybersecurity, and AI governance model.
- Builds scalable governance processes that enable global growth while protecting customers, employees, and other stakeholders.
- Positions IDEXX as a trusted steward of personal data.
for prose and
- for lists. Education and Experience Needed are lists of items. Success Profile and What Success Looks Like are also lists.
We could structure:
Qualifications
Education
Experience Needed
Success Profile
What Success Looks Like
Benefits
At IDEXX, you’ll be supported by competitive compensation, incentives, and benefits while enjoying purposeful work that drives improvement.
We should not include Pay or Schedule. Check for any boilerplate: EEO statement removed. Also removed "We’re proud of the work we do..." paragraph? Actually we included that in About the role. The "Why IDEXX" paragraph includes that. We need to ensure we didn't include any EEO or legal boilerplate. The final paragraph after "Why IDEXX" includes EEO statement; we omitted that. Check that we preserved all substantive information: The intro paragraph includes all details about role, partnerships, etc. We included that. The responsibilities list includes all bullet points. Qualifications includes education, experience, success profile, what success looks like. Benefits includes the statement about compensation. Check if any other substantive info: The "Why IDEXX" also includes: "We’re proud of the work we do, because our work matters. An innovation leader in every industry we serve since 1983, our team members help pet owners worldwide keep their companion animals healthy and happy, ensure safe drinking water for billions, and help farmers protect livestock and poultry from disease. We have customers in over 175 countries and a collaborative global workforce. Our culture embraces challenges and encourages learning and discovery." That's substantive about company. Should we include that? It's part of Why IDEXX. We could incorporate that into About the role