Privacy & AI Governance Program Manager

ORION•Omaha, NE

22h•$83,076 - $127,179•Hybrid

About The Position

As a Privacy & AI Governance Program Manager, you will be expected to spearhead privacy initiatives and coordinate cross-team collaboration, seeing privacy processes are followed through start to finish. Serving as Orion's operational hub for privacy, you will own the programs, processes, and documentation that keep the organization regulatory-ready and auditable, partnering closely with Legal, Information Security, and business leaders to build and scale privacy operations from the ground up. As Orion continues to adopt AI across its business, this role will also lead the organization's AI governance program from a privacy perspective — setting privacy expectations for how AI systems use personal information, reviewing AI use cases for privacy risk, and keeping Orion ahead of emerging AI-privacy requirements. This position will also have the opportunity to participate in crisis management by coordinating cross-functional responses and appropriate stakeholder involvement. It is anticipated that an incumbent in this role will work as a Hybrid employee, with three (3) or more days each week required on-site at one of the listed office locations. Candidates should be located within a commutable distance to an office. Internal candidates currently aligned to an Orion office location may be given preference; however, internal candidates with varying work arrangements may be considered based on experience and business needs. Work location is subject to change based on business needs.

Requirements

Prioritizes tasks based on importance to drive the success of the business and mitigate the organization’s risks
Has knowledge of the investment advisor industry, operations, and regulatory landscape
Has knowledge of federal and state privacy laws, rules, and regulations applicable to investment advisory and fintech business lines
Has a history of developing new policies and procedures based on changes to regulations or business operations
Learns and adapts to new systems and processes with limited direct training
Multi-tasks while maintaining careful attention to detail
Works effectively both individually and within a team environment
Works with a sense of urgency to meet deadlines and address competing priorities
Has proficient skills with Microsoft Office software including Word, Excel, PowerPoint, and Outlook
Has effective written, listening, and verbal communication skills
Has effective problem solving and organizational skills
Owns and manages relationships with stakeholders directly and work effectively with people at all levels in an organization
Has a proven track record of operationalizing and scaling cross-functional, organization-wide programs from the ground up
Analyzes complex problems to identify root causes and trends, and to translate complex requirements into simple, usable documentation and workflows
Works in a fast-paced, high-growth environment with tight timelines and shifting priorities
Has experience using AI tools to accelerate day-to-day privacy operations work
Has familiarity with global data-protection frameworks (e.g., GDPR) as applicable to Orion's operations
Has knowledge of privacy requirements applicable to AI, including automated decision-making and profiling rules under laws such as CCPA/CPRA and the Colorado AI Act
Understands core AI and machine-learning concepts and the associated data-privacy risks, such as the use of personal information in training and inference, profiling, and transparency
Demonstrates experience managing high-priority incidents and coordinating cross-functional crisis response efforts
Has strong ability to make risk-informed decisions under pressure and effectively communicate with executive leadership during crisis situations
Has a minimum of a Bachelors Degree; J.D. preferred
Has a minimum of 5 years of experience
Owns and manages relationships with stakeholders directly and works effectively with people at all levels in an organization

Nice To Haves

Recommended Skills: AI Governance, Data Privacy, Data Protection, Data Protection Privacy, Incident Response, Information Security, Privacy Compliance, Privacy Laws, Risk Assessments, Risk Management

Responsibilities

Serve as the primary privacy liaison and subject matter expert enterprise-wide, partnering with business and functional leaders across the organization to embed privacy considerations into business decisions, product development, and day-to-day operations
Develop, improves, and promotes the privacy framework, in conjunction with the vision of direct leadership, and directs and coordinates the privacy program, including associated risk to the organization
Promote a culture of privacy compliance across the organization through Policy, Process, and/or Procedures; provides guidance to resolve privacy issues brought up from business and functional areas representatives
Oversee and direct privacy planning and procedure development across the organization, including the management of privacy policies in coordinate with Legal, Risk, and Information Security
Identify potential areas of privacy vulnerability and risk, develop correction action plans for resolution of problematic issues, provide guidance of risk mitigation, and provide reporting to the Data Protection Officer
Design, develop, and deliver privacy training programs for new hires and existing employees across all business lines, including Potential Privacy Incident awareness training, annual privacy compliance training, and role-specific privacy guidance
Manage responses to Potential Privacy Issues, Orion’s Legal Department, Information Security Team, and relevant business lines
Serve as the organization's primary privacy investigator, managing the full lifecycle of Potential Privacy Incidents across all business lines (OAT and OWM) — from initial intake and triage through investigation, root cause analysis, client notification, and remediation tracking
Implement the Privacy Incident Response Plan, as needed
Manage the Data Subject Rights Request (DSSR) process, including reviewing, validating, and responding to requests and maintaining a repository of requests and responses
Report on data privacy matters to leadership and key collaborators, appropriately escalating any privacy risks as required
Maintain working knowledge of and operationalizes requirements under CCPA/CPRA, Reg S-P (amended), CIPA, and emerging state privacy laws as applicable to Orion's business lines
Work in coordination with Information Security Team and assist in Vendor Risk Assessments relating to Privacy
Assist with Data Privacy Impact Assessments for new and existing business lines, products, and services
Participate in Orion committee meetings to provide privacy-related input when necessary
Build and maintain Records of Processing Activities (ROPA), documenting how personal information is collected, used, shared, and retained across Orion's business lines
Identify and implement process improvements across the privacy program — developing structured workflows, playbooks, and response libraries, and leveraging AI tooling where appropriate — to automate routine tasks and sustain consistent, high-quality privacy operations at scale
Establish, track, and report on privacy program metrics to measure compliance and operational performance across business lines
Manage cookie and online-tracking compliance, including consent mechanisms, in coordination with Legal and business lines
Monitor legal and regulatory developments across applicable local, state, and federal privacy laws, and coordinate with Legal, Information Security, and business units to operationalize new requirements
Help lead and mature the organization's AI governance program and framework — defining responsible-AI principles, policies, and standards in coordination with Legal, Risk, Information Security, and business leaders
Maintain an inventory of AI and automated decision-making systems that process personal information, and operate a privacy intake, review, and approval workflow for new and existing AI use cases.
Conduct privacy reviews and impact assessments for AI and machine-learning use cases that involve personal information, evaluating data minimization, purpose limitation, transparency, and automated decision-making and profiling risks
Operationalize the privacy-related requirements of emerging AI regulation (e.g., automated decision-making and profiling rules under CCPA/CPRA and the Colorado AI Act) as applicable to Orion's business lines, coordinating with Legal to track and implement new requirements
Partner with Enterprise Risk Management, Legal, Compliance, Information Security, and Technology teams to manage incidents and crisis response activities
Support enterprise-wide crisis management and operational resiliency initiatives through response planning, stakeholder coordination, and participation in crisis management activities