Principal Security & Privacy Compliance Architect

Zscaler•Santa Clara, CA

3d•$196,000 - $245,000•Hybrid

About The Position

Zscaler is seeking a Principal Security and Privacy Compliance Architect to shape and scale security and privacy operational compliance across highly regulated cloud environments. The role bridges technical architecture, product engineering, legal privacy counsel, and federal and commercial compliance mandates. It translates complex regulatory frameworks into practical technical and operational solutions, supports critical system authorization efforts, elevates control maturity, and establishes scalable compliance practices that enable sustainable business growth. The position is hybrid, with three days per week at Zscaler’s Santa Clara headquarters, and reports to the Director, Technology Risk & Compliance in the Compliance Architect department. The architect leads security and privacy compliance architecture across multi-cloud environments, operationalizes privacy controls, evaluates AI/ML integrations, and serves as a subject-matter expert for privacy compliance initiatives involving auditors, customers, and internal engineering teams.

Requirements

Foundational understanding of AI/ML technologies and experience leveraging, securing, or positioning AI-driven solutions to optimize outcomes within the functional domain.
At least 8 years of progressive experience in Privacy Engineering and Information Security within cloud-native enterprise environments.
Operational mastery of GDPR, CCPA/CPRA, international cross-border transfer, SOC 1/SOC 2, C5, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001, NIST SP 800-53, FedRAMP, and DoD SRG (IL4/IL5).
Working knowledge of major public cloud service providers (AWS, Azure, or GCP), AI/ML platforms, containerized environments (Kubernetes/EKS), modern IAM (SAML 2.0, OIDC, Okta), and Zero Trust network architectures.
Demonstrated experience conducting security and privacy design reviews, data-flow mapping, PII lifecycle evaluations, threat modeling, and third-party vendor risk assessments.
Ability to translate nuanced legal and compliance obligations into concrete engineering requirements and actionable technical patterns without introducing operational drag.
Ability to work through ambiguity, take ownership, move between architectural strategy and hands-on execution, and collaborate effectively while giving and receiving feedback.

Nice To Haves

Ability to leverage AI technologies and workflows to drive measurable operational efficiency.
Hands-on experience designing and deploying AI-forward automated solutions for continuous control monitoring (CCM), automated evidence gathering, and compliance workflow orchestration in regulated cloud environments.
Experience establishing technical privacy governance for generative AI/LLM architectures, sovereign cloud deployments, and automated data discovery and classification pipelines.
Credentials such as CIPT, CIPP/US, CIPP/E, CIPM, CDPSE, CISSP, CCSP, or CRISC.

Responsibilities

Lead the design, implementation, and continuous maturity of security and privacy compliance architecture across multi-cloud environments subject to SOC 2, C5, GDPR, ISO 27701, FedRAMP High, and DoD IL5.
Lead and approve cross-border transfer and data residency design patterns, and turn unified privacy control catalogs based on NIST and ISO 27701 into actionable engineering specifications.
Facilitate end-to-end privacy and data security risk evaluations, including DPIAs, PIAs, and PTAs.
Serve as the primary technical liaison to Privacy Legal for post-incident remediation and corrective actions.
Evaluate corporate and product-embedded AI/ML integrations against frameworks such as ISO 42001 and NIST AI RMF, validating technical safeguards and model controls.
Serve as the Principal Compliance Architect subject-matter expert for privacy compliance initiatives supporting 3PAOs, external regulatory auditors, enterprise customers, and internal engineering teams.