Privacy Manager

Sezzle•United States, Remote, NH

5d•$125,000 - $190,000•Remote

About The Position

Sezzle is seeking a talented and motivated Privacy Manager to build and lead its company-wide privacy program based on the NIST Privacy Framework. This is a ground-floor opportunity with executive sponsorship, a defined roadmap, and drafted core program materials. The role involves implementing the program from foundation to operation, ensuring data practices protect users while enabling product and engineering teams to build at speed. The Privacy Manager will drive the implementation of the enterprise data map, privacy risk assessments, privacy review processes, de-identification standards, and governance rhythms. This position sits at the intersection of privacy and product, aiming to facilitate data initiatives with a fast, well-documented path to approval.

Requirements

4+ years of dedicated experience managing data privacy programs, including at least one program or major program component (a data inventory, a consumer rights operation, a privacy review process) that you stood up from early stage to steady state rather than inherited.
High-growth fintech, e-commerce, or SaaS experience operating in both the US and Canada is ideal.
Hands-on experience implementing a recognized privacy or security framework (NIST Privacy Framework strongly preferred; NIST CSF or ISO 27701 also relevant), including profiles or maturity assessments, gap analyses, and action plans.
Strong working knowledge of major North American privacy frameworks (CCPA/CPRA and the broader US state privacy law landscape, TCPA, GLBA, PIPEDA, Quebec Law 25) and a sharp knack for translating complex legal mandates into clear, actionable business processes.
You treat privacy as the path to yes.
Fluent in de-identification, aggregation, and other privacy-enhancing techniques as tools that let data products launch responsibly, and you can defend the line between what is de-identified and what is not.
High emotional intelligence (EQ) with the ability to influence technical and non-technical stakeholders alike, run a cross-functional working group, and present clearly to executives.
A self-starter mindset with the ability to manage multiple high-stakes projects simultaneously in an environment where speed and agility matter.

Nice To Haves

CIPM (privacy program management) plus CIPP/US or CIPP/C; CIPT is a plus.
Technical familiarity with modern privacy tech platforms (e.g., OneTrust, Securiti.ai, WireWheel) and data infrastructure analytics.
Experience navigating financial regulations and compliance frameworks (e.g., GLBA, PCI-DSS) alongside traditional consumer privacy laws.
Public-company experience, including supporting audit committee or board-level reporting.

Responsibilities

Drive Sezzle’s implementation of the NIST Privacy Framework from roadmap to operating program, including Current and Target Profiles, gap analysis, a prioritized and costed action plan, and ongoing monitoring, aligned with US state and federal requirements (CCPA/CPRA and other state comprehensive privacy laws, GLBA, TCPA) and Canadian privacy laws (PIPEDA and Quebec’s Law 25).
Own privacy risk assessments and Privacy Impact Assessments (PIAs) for new products, features, and third-party vendors, and operate an intake and disposition process that gives every proposal a fast, documented answer: approved, approved with controls, or needs redesign.
Build and maintain the enterprise data inventory and data map in partnership with Engineering, tracking the lifecycle of consumer information, and manage the automation and fulfillment of consumer access, deletion, and opt-out requests.
Administer Sezzle’s de-identification and aggregation standard and its approval workflow so that data-driven products and analytics ship with the right controls designed in from the start.
Partner directly with Engineering, Product, and Marketing teams during early-stage development so that privacy requirements are designed in, not bolted on.
Run the cadence of Sezzle’s cross-functional privacy working group, maintain the program’s decision log and obligations register, track program metrics, and support executive and board-level reporting.
Collaborate closely with the Information Security team to manage, investigate, and mitigate privacy incidents and cross-border data transfer risks.