Privacy and Compliance Program Manager

BAL•Richardson, TX

2d•Remote

About The Position

This role is responsible for designing and implementing privacy and compliance-related policies, controls, and processes. The Privacy and Compliance Program Manager will work with the BAL Information Security and Privacy Council (ISPC) to modify or develop policies and processes, and manage all applicable privacy activities and processes associated with ongoing maintenance and care of privacy compliance requirements such as EU-US DPF, GDPR, etc. The position involves facilitating project scope, goals, and deliverables, communicating with internal and external clients regarding privacy program actions (including breach processes), and advising on various privacy topics like incident response, leading privacy controls, and data subject access requests. The role also requires identifying, assessing, and communicating key privacy risks, monitoring and reporting on privacy program initiatives to the Senior Manager of Enterprise Security & Privacy, and leading Data Privacy Impact Assessments (DPIA) to minimize data protection risks. Additionally, the manager will monitor and document regulatory changes, support the third-party risk management program, assist with privacy audits and compliance checks, participate in contract reviews for privacy terms, supervise internal audits for ISO 27001 and 27701 compliance, lead critical ISO compliance activities, and own the Data Governance program, including updates to data maps and policy compliance. The role also includes serving as the administrator and subject matter expert for the OneTrust tool.

Requirements

Bachelor’s degree in Computer Science, Information Security or related field
60 months of progressive, post-baccalaureate experience in job offered or in a Privacy and Compliance Program Manager-related occupation.

Responsibilities

Design and implement privacy and compliance-related policies, controls, processes and leading practices.
Work with the BAL Information Security and Privacy Council (ISPC) to determine whether the privacy-related policies/processes need to be modified or developed and drive any necessary policy/process changes.
Manage, own, and coordinate all applicable privacy activities and processes associated with the ongoing maintenance and care of privacy compliance requirements such as EU-US DPF, GDPR, etc.
Facilitate the definition of scope, goals and deliverables for defined privacy program projects.
Responsible for communication to internal and external clients as it pertains to actions driven by the Privacy Program; including privacy breach processes.
Advise on a variety of privacy topics, including incident response, leading privacy-related controls, and responding to data subject access requests.
Identify, assess and communicate key privacy risks within the BAL operational environment.
Monitor and report on the ongoing initiatives of the privacy program to the Senior Manager of Enterprise Security & Privacy.
Lead the coordination of Data Privacy Impact Assessments (DPIA) to help identify and minimize the data protection risks across the organization.
Monitor, track, and document changes to regulatory and compliance requirements.
Provide ongoing support to the third party risk management program to include internal program development and external third party privacy assessment.
Supports privacy audits, compliance checks and external assessment processes for our internal and external auditors.
Participate in contract review and negotiation specific to privacy terms and data protection addendums.
Supervise and coordinate all required internal audits required for ISO 27001 and 27701 compliance.
Lead critical activities required to maintain ISO compliance, including, but not limited to, performance of risk assessments, mandatory clauses and control reviews.
Own the Data Governance program including updates to data maps and monitoring of compliance with documented policies and procedures.
Serve as the administrator of and subject matter expert (SME) for the OneTrust tool.