Data Privacy Manager

About the role

The Data Privacy Manager will lead the administration of the enterprise privacy program across Lendistry’s and affiliated and subsidiary entities. Reporting to the VP, Enterprise Security, this role is the organization's technical data privacy subject matter expert, translating regulatory requirements into concrete technical controls and auditable processes.

Responsibilities

• Lead the administration of the enterprise privacy program across Lendistry’s and affiliated and subsidiary entities.
• Design, implement, and manage solutions to protect personal data, embedding “privacy by design” into the software development lifecycle, product architecture, and AI/ML privacy integration.
• Translate privacy policy and regulatory requirements into actionable requirements such as data minimization, encryption, tokenization, data masking, anonymization, and access controls.
• Maintain and continuously update enterprise data flow diagrams and data inventories to map the lifecycle of personal information from ingestion to deletion.
• Lead and document annual privacy risk assessments, including Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs).
• Manage first-line-of-defense compliance with the technical requirements of applicable US state privacy laws (CCPA/CPRA, GLBA Safeguards Rule, and the growing patchwork of state statutes).
• Support incident response activities related to data privacy, including breach assessment, documentation, and regulatory support, in partnership with the Security and Legal.

Requirements

Core Experience:

• 5+ years in privacy, data protection, or a closely adjacent field, with a clear pattern of growing program ownership and regulatory accountability.
• Hands-on experience supporting regulatory and compliance programs, including SOC 2 and GLBA Safeguards Rule, along with familiarity with U.S. state privacy laws (CA, CO, VA, CT, UT, TX, OR, MT, NJ, TN, IA, IN, DE, NE, NH, MD, MN) and global frameworks such as GDPR, PIPEDA, LGPD, or DPDPA.
• Demonstrated ability to perform privacy and security risk assessments — PIAs, DPIAs, and data security risk assessments — with strong documentation and evidence-management practices.
• Deep working knowledge of CCPA/CPRA, including consumer rights, sensitive personal information, service provider vs. third-party distinctions, opt-out signals, and CCPA enforcement expectations.
• Deep working knowledge of GLBA (Privacy Rule and Safeguards Rule) and how GLBA interacts with state privacy laws for financial institutions.

Skills

• Understanding of privacy engineering and secure system design, including familiarity with privacy-enhancing technologies such as differential privacy, federated learning, and secure multi-party computation (particularly in AI/ML pipelines).
• Working knowledge of data mapping and automation tools used to manage data subject rights requests and privacy operations workflows (e.g., OneTrust, Archer, TrustArc, Transcend, Osano, or equivalent).
• Experience embedding privacy into product development — reviewing features, data flows, and vendor integrations at the point of design rather than at launch.
• Experience overseeing privacy for AI or automated decisioning systems — data minimization, training data governance, consumer disclosure, and fair lending intersections.

Qualifications

• CIPM or CISSP certification preferred.
• CIPP/US, CIPP/E, CIPM, CIPT, or FIP privacy certifications.
• Experience in SBA lending, CDFI operations, or other federally regulated financial institutions.
• Experience with state lending examinations, CFPB matters, or other consumer-protection regulator engagement.
• Experience with the NIST Privacy Framework and NIST AI Risk Management Framework.
• Experience building privacy programs across multiple legal entities or operating subsidiaries.
• Experience with cross-border operations.