Data Privacy Specialist US

Enstar Group

18h•$130,000 - $145,000

About The Position

The Data Privacy Specialist works in Enstar’s Global Data Privacy team, reporting to the Data Privacy Manager and collaborating with colleagues in the UK, US, and other time zones. This Group-wide role provides day-to-day specialist privacy advice so personal data is handled lawfully, consistently, and demonstrably across the jurisdictions in which Enstar operates. The role covers all disciplines of data privacy rather than a specific specialty and includes delivery of assigned workstreams in the data privacy maturity programme. The specialist exercises independent judgement when analysing complex, multi-jurisdictional issues and recommends proportionate solutions. Enstar’s business includes acquired portfolios, so the work may involve inherited records, legacy systems, long retention periods, and processing designed under previous owners. The specialist helps determine priorities within those constraints and escalates appropriately. Legal conclusions and acceptance of business risk remain with the Head of Data Privacy, the DPO, and relevant business owners. The role encompasses privacy assessments, data subject rights, records of processing, regulatory compliance, notices and consent, supplier due diligence, processing agreements, international transfers, incidents and breaches, privacy training, risk management, policies, and programme reporting. The specialist also advises project teams on Privacy by Design and Default, supports the Privacy Champions network, and translates complex requirements into practical guidance for non-specialists. Enstar is a global re/insurance group and a provider of retrospective solutions, with specialist underwriting capabilities and close to 800 professionals. Its learning and development resources include professional qualifications and study support, training, conferences, seminars, continuing professional development, and a digital learning hub. Enstar also describes wellbeing initiatives and a commitment to reducing its environmental impact. The role’s target base salary range is $130,000–$145,000, subject to hiring location and candidate qualifications, skills, and experience; this range excludes applicable discretionary incentives.

Requirements

A minimum of four to six years of substantive, hands-on data privacy experience.
Relevant professional qualification such as CIPP/E, CIPM, or equivalent.
Demonstrable expertise in UK GDPR and the Data Protection Act 2018.
Solid working knowledge of EU GDPR and at least one of US privacy law (GLBA, CCPA/CPRA, or state privacy laws) or Australian privacy law (Privacy Act 1988, APPs, or NDB scheme).
Breadth across all disciplines of data privacy rather than deep specialism in one or two areas.
Practical experience handling data subject rights at volume, including DSARs in a regulated-sector context.
Proven experience conducting DPIAs and providing Privacy by Design advice to business stakeholders.
Experience negotiating and reviewing Data Processing Agreements and international data transfer mechanisms.
Demonstrable experience managing personal data breaches and advising on regulatory notification obligations.
Ability to plan and deliver assigned workstreams on time and report progress.
Ability to work productively and visibly in a remote setting across time zones.
Clear written English, including the ability to prepare policies and guidance that non-specialists can follow.

Nice To Haves

Experience in insurance or reinsurance and familiarity with insurance-specific processing such as claims, underwriting, fraud prevention databases, and actuarial processing.
Further certification such as CIPM, CIPT, or Fellow of Information Privacy, or a relevant legal qualification.
Knowledge of the NAIC Insurance Data Security Model Law and state insurance commissioner notification requirements.
Familiarity with the California Insurance Information and Privacy Protection Act (IIPPA) and its 2023 amendments.
Experience working in a multi-jurisdictional privacy programme spanning EEA, UK, US, and/or Australian operations simultaneously.
Experience conducting privacy due diligence and integration on mergers, acquisitions, or portfolio transfers.
Familiarity with ISO 27701, ISO 27001, SOC 2, or NIST, and experience working alongside an information security team.
Hands-on use of privacy management tools such as OneTrust or TrustArc, including consent management platforms.
Technical literacy to read data-flow or architecture diagrams and understand deletion across databases, logs, archives, and backups.
Interest in artificial intelligence governance and emerging obligations under the EU AI Act.
Legal qualification (solicitor, barrister, or overseas equivalent) or privacy law academic background.

Responsibilities

Provide day-to-day specialist data privacy advice across the Group and deliver assigned data privacy maturity programme workstreams.
Contribute to baseline assessments across entities and jurisdictions and deliver assigned workstreams through evidenced closure.
Analyse complex, multi-jurisdictional privacy issues, recommend proportionate solutions, prioritise work involving inherited records and legacy systems, and escalate appropriately to the Data Privacy Manager.
Advise project teams on Privacy by Design and Default and deliver related training.
Produce PIAs, DPIAs, and LIAs, including assessments referred after Analyst screening, and submit them to the Data Privacy Manager for quality review.
Advise on data subject rights requests across jurisdictions, handle complex or multi-jurisdictional cases, and ensure requests are recorded end to end.
Maintain and update the record of processing activities (ROPA), supporting the Data Privacy Manager.
Support compliance with applicable data protection legislation across operating jurisdictions and monitor regulatory developments through horizon scanning.
Assist with regulatory registrations and filings.
Review and update privacy notices and cookie consent management.
Assist with privacy due diligence on third-party suppliers.
Review Data Processing Agreements and recommend changes.
Assist with international data transfer mechanisms, keep them current and documented, and maintain oversight of cross-border data flows arising from third-party arrangements.
Produce transfer impact or risk assessments where required and develop recommendations for the Data Privacy Manager’s review.
Assist in handling personal data incidents from identification to resolution and, where required, support the DPO in assessing and managing notifiable breaches across jurisdictions.
Liaise with Information Security to align incident management processes and assist with testing the Data Breach Response Plan.
Translate complex privacy requirements into practical guidance for non-specialists across the Group.
Design and deliver privacy training for employees and contractors, monitor completion rates, and promote privacy awareness.
Coordinate the deployment, day-to-day support, and development of the Data Privacy Champions network.
Assist with maintaining and developing the data privacy risk register within the Group’s ERM framework across jurisdictions.
Identify and assess privacy risks, develop proportionate mitigation recommendations and controls, deliver assigned mitigation actions, and track and report progress with relevant business functions.
Assist with reviewing data protection policies and procedures across jurisdictions.
Prepare management information and reports on privacy programme status for the Data Privacy Manager and relevant stakeholders.
Coordinate with colleagues in the UK, US, and other time zones.

Benefits

Medical, dental, and vision healthcare for single and family coverage.
Virtual access to board-certified doctors and pediatricians 24/7 for urgent care.
Health Savings Account (HSA) or Flexible Spending Account (FSA).
Dependent Care FSA for daycare expenses.
Employee Assistance Programs (EAP) for health and well-being.
Optional pet and home/auto insurance.
Wellness reimbursement of up to $600 annually for wellness-related expenses.
401(k) retirement plan with company matching up to 6% of employee contribution.
One paid annual volunteer day.
Professional qualification and study support.
Access to training, conferences, seminars, and continuing professional development opportunities.
Digital Learning Hub with LinkedIn Learning resources.
Physical, mental, and financial wellbeing initiatives.