Compliance Assurance Program Manager

Meta•Washington, DC

2d•$118,000 - $173,000

About The Position

The Compliance Assurance Program Manager (CAPM) works across privacy regulation, legal, business, product, and engineering to help keep users’ privacy central to Meta’s work. The role is part of the Exam & Audit (E&A) team within Meta’s Regulatory Compliance Program (RCP), which manages regulatory examination and audit engagements by connecting internal stakeholders with external assessors and regulators. E&A coordinates external assessor testing, responds to findings, drives remediation, and provides second-line compliance advice and independent oversight of privacy safeguards. This position focuses on Third Party Risk Management (TPRM), covering safeguards governing how developers, partners, vendors, and service providers access, use, and protect Meta user data. As an individual contributor and trusted second-line advisor, the CAPM will lead readiness for independent assessment of third-party safeguards, advise on privacy risks and controls, and help develop a comprehensive privacy compliance program.

Requirements

At least 5 years of experience in Governance, Risk, and Compliance (GRC), internal or external audit, or risk management, including third-party or vendor risk management, data privacy, or security.
At least 2 years of experience delivering technical programs or products from inception to delivery across organizations.
Working knowledge of privacy regulations such as GDPR and CCPA, and third-party risk frameworks or standards such as NIST, ISO 27001/27036, or SOC 2.
Experience testing or assessing control design and operating effectiveness and preparing evidence for regulators or external auditors.
Prior experience working with program management directly in product or engineering, coupled with ITGC experience.

Nice To Haves

Experience using AI or automation to scale compliance testing, evidence review, or reporting.
Ongoing AI skill development, such as prompt/context engineering or agent orchestration, and awareness of emerging AI technologies.
Ability to integrate AI tools to optimize or redesign workflows and deliver measurable impact, such as efficiency gains or quality improvements.
Experience designing, operating, or assessing platform safeguards or API governance controls, such as developer access permissions and scopes, app review, data-use restrictions, rate limiting, or third-party data-access monitoring.
Experience with regulatory consent orders or decrees, especially FTC Consent Order provisions covering third parties.
Experience designing, implementing, and maintaining scalable global compliance operations.
Experience managing and directing contingent workers and contractors specializing in privacy and security program management.
Design-thinking process-improvement experience using creativity and structure to solve complex problems while putting the user first.
Experience in a leadership capacity influencing stakeholders and engineers.
Experience working in a technical environment and prior cross-group collaboration experience.
Bachelor’s or Master’s degree in a related discipline, or equivalent practical experience.
Experience adhering to and implementing responsible, ethical AI practices, such as risk assessment, bias mitigation, and quality and accuracy reviews.

Responsibilities

Serve as the second-line compliance partner for TPRM safeguards across the third-party lifecycle, including onboarding and due diligence, contracts and platform terms, data access and API permissions, ongoing monitoring, enforcement, offboarding, and data deletion.
Lead FTC Consent Order Assessment readiness for assigned TPRM safeguards by coordinating assessor requests, reviewing populations, samples, and evidence, and owning response narratives through delivery.
Advise privacy domains on navigating global and data privacy regulations.
Assess how new third-party integrations and platform capabilities affect Meta’s privacy posture and safeguards or controls.
Provide independent oversight to identify issues, ensure visibility, prioritize remediation, and act as an escalation point and advocate for risk mitigation.
Develop long-term objectives and documented roadmaps, goals, and objectives for evolving the privacy program operating model while delivering immediate priorities.