Data Privacy Program

Contract role (6 months, possible extension) at $70–80/hr, Monday–Friday 8 am–5 pm. Targeting candidates in New York; open to Washington, DC and Seattle. You’ll join a lean TechOps and engineering group, working heavily with the TechOps team. Nice-to-have: insider‑risk program experience and comfort collaborating with engineers and product developers. Minimum 5 years’ program/project management experience; proficiency with Google Workspace (Google Suites) required.

Responsibilities

• Data Privacy Program & Data Mapping / ROPA Delivery: Serve as day‑to‑day Project Manager for the Protiviti‑led Data Mapping, Records of Processing Activities, and Privacy Program Support engagement. Ensure timely completion of Discovery & Design, Assessment & Validation, Reporting, and Phase 2 Planning activities. Develop and maintain detailed project plans, workstream trackers, budget and hours‑consumed reporting, risk logs, and weekly status materials. Coordinate stakeholder interviews, system‑owner workshops, documentation requests, and follow‑up across business, technology, legal, compliance, and functional teams. Support configuration and privacy technology enablement with external advisors and CBRE technology stakeholders. Synthesize project outputs into practical implementation roadmaps for privacy operations integration, DSAR and PIA program maturity, data discovery, and monitoring capabilities. Track dependencies, open issues, decisions, and escalations for timely execution and leadership visibility.
• Cybersecurity Integration Program Enhancement: Coordinate completion of cybersecurity integration action items — application registration in CBRE’s Application Portfolio Management system, Vulnerability Disclosure Program rollout, Cyber Risk Questionnaire and Cyber Control Self‑Attestation compliance gates, and AI/ML assessment intake processes. Partner with CBRE cybersecurity, engineering, and product stakeholders to support adoption of CBRE’s Secure Development Life Cycle, infrastructure onboarding, and related security review processes. Support execution of CBRE‑aligned cybersecurity and privacy incident response processes, including tabletop exercises, escalation‑path awareness, and coordination with CBRE Security Operations and Global Data Privacy stakeholders. Maintain corrective‑action trackers and drive owners toward timely remediation. Provide clear, concise status updates to Industrious leadership, CBRE integration stakeholders, and governance forums. Promote operational alignment and business adoption of cybersecurity and privacy requirements in a practical, risk‑based manner.
• Program & Stakeholder Management: Support the Head of Compliance & Privacy in maintaining a consolidated tracker of Compliance and Data Privacy Integration Plan action items across governance & operating model, policies & notices, data mapping & ROPA, DSAR, PIA/DPIA, third‑party risk, training, and awareness workstreams. Assist with vendor and procurement administration for third‑party engagements (SOW execution, requisition tracking, milestone invoicing, documentation). Facilitate recurring cross‑functional working sessions and manage action items across Industrious business, legal, technology, compliance stakeholders and CBRE Compliance, Legal, Cybersecurity, and Digital & Technology teams. Prepare polished, executive‑ready status updates, dashboards, risk registers, and committee materials. Operate in both Google Workspace and Microsoft 365 environments. Improve and change existing methods, processes, and standards within the engagement scope. Model behaviors consistent with CBRE RISE values. Other job‑related duties may be assigned.

Requirements

• Minimum 5+ years of program or project management experience, ideally spanning technology, cybersecurity, data privacy, compliance, or risk‑related domains.
• Hands‑on technology or technical program experience required — software delivery, IT/engineering program management, cybersecurity operations, technology risk, or similar discipline.
• Demonstrated experience managing multi‑workstream projects delivered with external advisory/consulting firms and internal cross‑functional stakeholders.
• Working knowledge of data privacy program components (data mapping, ROPA, DSAR, PIA/DPIA, privacy technology enablement, privacy operations) preferred.
• Working knowledge of cybersecurity governance concepts (incident response, vulnerability management, application security onboarding, secure development processes, compliance gates) preferred.
• Familiarity with privacy technology platforms such as OneTrust a plus.
• Strong proficiency with Microsoft 365 (Outlook, Teams, SharePoint, Excel, PowerPoint).
• Strong proficiency in Google Workspace (Gmail, Drive, Meet, Calendar, collaboration tools) preferred.
• Exceptional organizational, communication, stakeholder management, and relationship‑building skills.
• Ability to translate technical, privacy, and cybersecurity details into clear, concise updates for senior leadership and cross‑functional audiences.
• Strong entrepreneurial mindset; ability to work independently and collaboratively in a fast‑paced, high‑growth environment.
• Demonstrated ability to manage change, drive accountability, and influence stakeholders in a matrixed organization.
• Extensive organizational skills and an inquisitive mindset.

Pay

$70–80 per hour.

Schedule

Monday–Friday, 8 am–5 pm.