Manager, Technology Compliance, Greater China

Apple

About The Position

Apple's IS&T Greater China Compliance organization is seeking a Manager in Shanghai to lead our compliance team in China and own the compliance posture of solutions running in-country. This is a broad remit spanning privacy, financial, payment, and information security regimes — including PIPL, SOX, PCI DSS, MLPS, and other applicable Chinese and global requirements — across a complex enterprise technology landscape. You will define how IS&T demonstrates compliance for in-country systems: designing the programs, standing up the controls, evidence, and monitoring that operate them, and hiring and developing the team that delivers them. Privacy and personal information protection are a significant part of this remit, but not the whole of it — you'll be equally comfortable reasoning about financial reporting controls, cardholder data environments, and information security grading and filing obligations. This is a hands-on leadership role, and it carries the technical and business depth of a senior individual contributor in addition to people leadership. At Apple, managers are expected to be in the details: reading the regulation, reviewing the assessment, sitting in the design review, and querying the data themselves. You'll set direction and remove obstacles for your team, and you'll also do the work alongside them — because credibility with engineering partners is earned through technical depth, not org charts. You will partner closely with the US-based IS&T Security, Privacy, and Compliance team, as well as individuals in Legal, Privacy, Information Security, Internal Audit, Finance, Engineering, and other organizations to establish a coordinated, risk-based approach to identifying, assessing, governing, and monitoring in-scope systems and processing activities. You'll also partner closely with a peer compliance team in the United States, sharing methodology, tooling, and lessons learned so that both regions operate to a consistent standard while meeting the distinct requirements of their jurisdictions. You'll bring the rigor of an auditor, the discipline of a program leader, and the technical depth to propose and reason about data platforms, pipelines, and data at scale.

Requirements

8+ years of experience in technology compliance, IT audit, risk management, information security, privacy, or data governance
2+ years of experience leading teams, or leading large cross-functional programs with demonstrated ownership of scope, staffing, and outcomes
Experience hiring, coaching, and developing people, or a clear track record of technical mentorship and readiness to build a team
Experience defining compliance or risk program strategy and designing the frameworks, methodologies, and controls that operationalize it
Hands-on experience across multiple compliance regimes, such as PIPL, SOX / ITGC, PCI DSS, MLPS, GDPR, CCPA/CPRA, ISO 27001, or comparable frameworks
Experience with regulatory requirements applicable to technology operations in China
Experience with data classification, data governance, data inventories, or data-flow mapping
Familiarity with cloud environments, enterprise applications, APIs, data platforms, and software development life cycle methodologies
Ability to evaluate technical designs and architectures against control objectives and articulate gaps to both engineering and non-technical audiences
Demonstrated ability to translate regulatory, policy, or control requirements into practical and scalable processes
Experience influencing senior stakeholders and building consensus across matrixed, cross-functional organizations
Professional fluency in both Mandarin and English, with strong written and verbal communication skills in each, including the ability to frame complex concepts for executive audiences
Ability to operate effectively in an ambiguous, evolving regulatory environment and to set direction for others within it
Bachelor's degree or equivalent practical experience

Nice To Haves

Audit or advisory experience at a Big 4 or comparable professional services firm, including experience leading engagement teams
Experience building a compliance, privacy, or risk function from an early stage
Experience with PIPL implementation at scale, including cross-border data transfer governance and security assessment or standard contract filing
Experience managing SOX ITGC scoping, testing, and remediation cycles for enterprise systems
Experience with PCI DSS assessments, including scoping of cardholder data environments
Experience with MLPS grading, filing, and remediation, or with Chinese cybersecurity and data security regulatory engagement
Experience with Privacy Impact Assessments, Data Protection Impact Assessments, or similar risk assessment methodologies
Proficiency in SQL and familiarity with Python and large-scale data ecosystems; comfort applying data science concepts to compliance monitoring
Proficiency with AI tools and techniques — using generative AI and ML-based agents to automate analytical and compliance workflows, accelerate assessment and evidence review, and expand monitoring capabilities at scale
Experience working across global and in-country teams in a multinational organization
Privacy, risk, audit, security, or compliance certifications (e.g., CIPP, CIPM, CISA, CISSP, CRISC, PCI ISA/QSA)
Excellent presentation and storytelling skills
Advanced degree in a technical, quantitative, legal, or related field

Responsibilities

Strategy: Define the multi-year compliance strategy and roadmap for IS&T solutions in China across PIPL, SOX, PCI DSS, MLPS, and other applicable regimes. Anticipate emerging regulatory obligations, assess their impact on Apple's systems and data, and shape the organization's response before requirements land.
Program design: Architect compliance programs from first principles — control frameworks, assessment methodologies, evidence and testing approaches, governance forums, intake and escalation paths, and the metrics that prove they work. Where obligations overlap across regimes, design a common control set once and map it to many, rather than running parallel programs.
Build and lead the team: Define the team's shape and hire against it, growing a group of compliance professionals in China from the ground up. Set a high bar for analytical rigor and written clarity, establish career paths, give direct feedback, and create the conditions for people to do the best work of their careers.
Privacy and personal information protection: Own PIPL compliance for in-country solutions — governance of high-risk personal information processing, privacy assessments, data subject rights enablement, and cross-border data transfer requirements.
Stay in the details: Personally review assessments, findings, control designs, evidence packages, and reporting. Engage directly in technical design reviews and regulatory analysis. Maintain enough hands-on fluency with the data and systems to validate your team's conclusions and to be a credible partner to engineering leaders.
Design review and control fit: Evaluate proposed architectures, data flows, and technical designs to assess their fit with control objectives — identifying where a design satisfies requirements, where it falls short, and what alternatives would meet the objective more efficiently. Engage engineering teams early, so controls are built in rather than retrofitted.
Requirements translation: Partner with Legal, Privacy, and Internal Audit to convert regulatory obligations and internal policy into practical, testable control requirements and repeatable operating processes.
Audit and assessment readiness: Own readiness for internal and external audits, assessments, and regulatory filings affecting in-country solutions. Coordinate with auditors and assessors, manage evidence collection, and drive findings to closure.
Risk governance and accountability: Own the risk picture for solutions running in China. Drive findings and commitments to closure, escalate with clarity, and hold owners across the organization accountable for outcomes.
Monitoring and reporting: Establish monitoring, metrics, and dashboards that give engineering leaders and executives a clear, honest view of compliance posture and emerging risk. Present to senior leadership in China and globally, and translate technical detail into decisions.
Cross-functional and cross-region leadership: Build strong relationships within China, with the sister compliance team in the United States, and with Apple's global functions and partner organizations. Bridge in-country requirements and global standards, drive alignment across time zones, and foster a unified approach to program goals.
Enablement and advocacy: Champion adoption of compliance platforms, tooling, and standards across the organization. Lead education and awareness initiatives in partnership with engineering teams.