Privacy and Compliance Program Manager

B A L•Richardson, TX

1d•Remote

About The Position

This role is responsible for designing and implementing privacy and compliance-related policies, controls, processes, and leading practices. The Privacy and Compliance Program Manager will work with the BAL Information Security and Privacy Council (ISPC) to drive necessary policy and process changes. This position manages and coordinates all applicable privacy activities and processes associated with ongoing maintenance and care of privacy compliance requirements such as EU-US DPF, GDPR, etc. The role also involves facilitating project scope, goals, and deliverables, communicating with clients regarding privacy program actions (including breach processes), and advising on various privacy topics like incident response, leading privacy controls, and data subject access requests. Key responsibilities include identifying and communicating privacy risks, monitoring and reporting on privacy program initiatives, leading Data Privacy Impact Assessments (DPIAs), tracking regulatory changes, supporting the third-party risk management program, and participating in privacy audits and contract reviews. Additionally, the role supervises internal audits for ISO 27001 and 27701 compliance, leads critical ISO compliance activities, and owns the Data Governance program, including updates to data maps and compliance monitoring. The Privacy and Compliance Program Manager will also serve as the administrator and subject matter expert for the OneTrust tool. This position may telecommute.

Requirements

Bachelor’s degree in Computer Science, Information Security or related field
60 months of progressive, post-baccalaureate experience in job offered or in a Privacy and Compliance Program Manager-related occupation.

Responsibilities

Design and implement privacy and compliance-related policies, controls, processes and leading practices.
Work with the BAL Information Security and Privacy Council (ISPC) to determine whether the privacy-related policies/processes need to be modified or developed and drive any necessary policy/process changes.
Manage, own, and coordinate all applicable privacy activities and processes associated with the ongoing maintenance and care of privacy compliance requirements such as EU-US DPF, GDPR, etc.
Facilitate the definition of scope, goals and deliverables for defined privacy program projects.
Responsible for communication to internal and external clients as it pertains to actions driven by the Privacy Program; including privacy breach processes.
Advise on a variety of privacy topics, including incident response, leading privacy-related controls, and responding to data subject access requests.
Identify, assess and communicate key privacy risks within the BAL operational environment.
Monitor and report on the ongoing initiatives of the privacy program to the Senior Manager of Enterprise Security & Privacy.
Lead the coordination of Data Privacy Impact Assessments (DPIA) to help identify and minimize the data protection risks across the organization.
Monitor, track, and document changes to regulatory and compliance requirements.
Provide ongoing support to the third party risk management program to include internal program development and external third party privacy assessment.
Supports privacy audits, compliance checks and external assessment processes for our internal and external auditors.
Participate in contract review and negotiation specific to privacy terms and data protection addendums.
Supervise and coordinate all required internal audits required for ISO 27001 and 27701 compliance.
Lead critical activities required to maintain ISO compliance, including, but not limited to, performance of risk assessments, mandatory clauses and control reviews.
Own the Data Governance program including updates to data maps and monitoring of compliance with documented policies and procedures.
Serve as the administrator of and subject matter expert (SME) for the OneTrust tool.