Senior Manager, Privacy Program

Topstep

2d•$155,000 - $185,000

About The Position

The Senior Manager, Privacy Program is a strategic leader responsible for user data integrity and technical governance at Topstep. This role builds, leads, and matures the company’s privacy and technical governance program, sets enterprise-wide strategy to meet global regulatory obligations such as GDPR and CCPA, and directly manages a specialized team comprising a Technical Governance & Operational Readiness Manager and a Privacy Operations Manager. The role integrates Privacy by Design into products, oversees data subject requests, and establishes automated, continuous IT governance audit readiness for frameworks such as SOC 2 and ISO 27001. The position directs the enterprise privacy program and its governance framework, policies, standards, and procedures; oversees data classification, records of processing activities, and data flow mapping; and advises Product Management and Engineering leadership on privacy-first design. It also oversees privacy operations, incident response, vendor privacy risk, and technical governance roadmaps, including automation of control monitoring and evidence collection. The role reports metrics and control health to executives and works across Legal, Security, Product, Engineering, and other teams to translate legal and technical requirements into practical guidance. Topstep describes its working environment as ranging from fully remote to hybrid, with collaboration supported by cameras-on meetings and Slack. The position offers a base salary range of $155,000–$185,000 annually and is eligible for a performance-based bonus. The company lists paid holidays, family leave, front-loaded paid time off, 401(k) matching, health, dental, and vision insurance for full-time employees, and additional vacation, food, grocery, and wellness perks.

Requirements

At least 8 years of progressive experience in privacy, data protection, or IT Governance & Risk programs within regulated environments such as fintech, financial services, or SaaS.
At least 3 years of direct people-management experience, including hiring, mentoring, and scaling governance, risk, or privacy teams.
Deep working knowledge of global privacy regulations such as GDPR and CCPA/CPRA.
Strong understanding of security and control frameworks such as SOC 2 Type II, ISO 27001, and NIST CSF.
Familiarity with privacy automation software such as DataGrail, OneTrust, or Transcend, and governance and risk platforms such as Vanta, Drata, or LogicGate.
Engineering literacy to oversee technical governance roadmaps and understand development pipelines, cloud architecture, and access controls.
Demonstrated experience moving assurance and control functions from reactive, manual processes to proactive, automated, metrics-driven operations.
Exceptional ability to translate complex legal and technical requirements into practical guidance for non-experts, with executive presence to report to the C-suite.

Responsibilities

Direct, mentor, and develop a high-performing team of privacy and technical governance professionals; set OKRs, conduct performance reviews, and foster continuous operational improvement.
Integrate privacy operations, including DSARs and vendor reviews, with technical IT governance initiatives such as automated control monitoring and audit readiness.
Establish and monitor team KPIs, ensure statutory privacy-request timelines are met, and provide executive visibility into technical control health and framework alignment.
Design, implement, and direct the enterprise-wide privacy program, including its governance framework, policies, standards, and procedures.
Oversee the data classification system, maintenance of Records of Processing Activities (RoPA), and continuous data flow mapping.
Advise Product Management and Engineering leadership and ensure privacy-first design and development are embedded in products, services, and features before launch.
Direct the development and delivery of role-specific privacy and data security awareness campaigns.
Oversee the end-to-end DSAR program and scalable workflows for access, deletion, and correction requests in alignment with global legal expectations.
Serve as the primary escalation point and incident commander for privacy incidents and data breaches; partner with Security and Legal on investigation, containment, remediation, and regulatory notification.
Oversee vendor privacy risk assessments, including evaluation of Data Processing Agreements and vendor alignment with Topstep privacy standards.
Oversee execution of the technical governance roadmap and alignment with company policies and SOC 2, ISO 27001, and NIST frameworks.
Champion automated control tracking and evidence collection using cloud-native GRC platforms, directing the Technical Governance Manager in this work.
Ensure technical procedures, review attestation, and exception tracking are centralized and operationalized across engineering partners.