Senior Privacy Analyst

Upbound Group•Plano, TX

3d•Onsite

About The Position

The Senior Privacy Analyst is the senior operating role on Upbound Group’s privacy team, working under the Director of Privacy/Data Protection Officer (DPO). The position leads day-to-day execution of the privacy program across the company’s brands and subsidiaries, translating program strategy into repeatable assessments, vendor reviews, data inventories, AI governance records, and metrics. The role operates with limited supervision, owns assessment quality and record integrity, and guides the Privacy Analyst I. It provides Legal, Information Security, GRC, Procurement, Product, and brand leaders with clear, risk-based recommendations and supports operational integration of subsidiaries into the enterprise privacy program under the DPO’s direction. The Senior Privacy Analyst leads privacy risk management, data mapping, data flow analysis, PIAs and DPIAs, risk-register maintenance, and privacy-by-design reviews. The role leads third-party privacy due diligence, reviews and redlines DPAs, evaluates vendor evidence, manages vendor privacy workflows, and supports offboarding and incident response. It maintains AI governance inventories and evidence, prepares AI impact assessments and reporting, and coordinates DPO-approved requirements across relevant teams. The role also leads consumer-rights workflows, cookie and tracking technology governance, retention and disposal initiatives, and privacy-related technical requirements. It supports incident response, tabletop exercises, assurance reporting, audits, and monitoring of legal and regulatory developments. The Senior Privacy Analyst leads operational integration of subsidiaries into the privacy program, guides and mentors the Privacy Analyst I, develops procedures and training materials, and serves as a working point of contact for Brand Privacy Leads and cross-functional groups as delegated by the DPO. The DPO retains final authority for program direction, risk acceptance, exceptions, escalations, regulator engagement, and approvals.

Requirements

Bachelor’s degree in Privacy, Law, Compliance, Information Technology, Cybersecurity, Risk Management, Business, Data Analytics, or a related field; equivalent relevant experience may be considered.
Five or more years of experience in privacy, third-party risk management, compliance, information security, or a related field.
Demonstrated experience conducting PIAs, DPIAs, and vendor privacy risk assessments.
Demonstrated experience reviewing, drafting, or negotiating DPAs and related data protection terms.
Experience managing assessment workflows, evidence, remediation, and reassessments in OneTrust or a comparable platform.
Experience supporting AI governance activities, such as inventory or use-case tracking, impact assessments, monitoring, regulatory research, documentation, or governance reporting.
Advanced knowledge of privacy risk management, PIAs and DPIAs, privacy by design, and third-party privacy risk.
Strong command of U.S. state privacy laws, GLBA, the FTC Safeguards Rule, breach notification requirements, and emerging AI, automated decision-making, and biometric laws.
Ability to review and redline DPAs and interpret vendor security evidence, including SOC reports and certifications.
Hands-on experience with privacy and governance platforms such as OneTrust, Securiti.ai, and Microsoft Purview.
Working technical fluency in cloud environments, APIs, cookies and tracking technologies, data classification, DLP, and access management.
Strong analytical judgment to distinguish material from non-material findings and communicate defensible recommendations.
Excellent written and verbal communication skills for executives, attorneys, engineers, and vendors.
Ability to manage competing priorities, own deadlines, and coach junior team members.
Ability to support AI governance through use-case tracking, risk tiering, impact assessments, regulatory research, evidence management, and concise reporting to the DPO and governance committees.

Nice To Haves

Experience in financial services, fintech, or consumer finance.
Professional certification such as CIPP/US, CIPM, CIPT, or AIGP.
Familiarity with Mexico’s LFPDPPP.

Responsibilities

Lead data mapping and data flow analysis across brands and subsidiaries; maintain data inventories and records of processing in Securiti.ai and OneTrust.
Lead PIAs and DPIAs for systems, vendors, products, and processing activities, and assist the Privacy Analyst I in reviewing submissions for completeness and relevant privacy considerations.
Assign and document privacy risk ratings, maintain the privacy risk register, and prepare recommendations for DPO decisions and sign-off.
Embed privacy by design through early reviews with Product, Engineering, and Technology teams and defined DPIA triggers.
Lead privacy due diligence for new and existing vendors, including onboarding, renewals, material scope changes, reassessments, and lookback initiatives.
Review and redline DPAs against the Upbound DPA Standard, track deviations, partner with Legal and Procurement to resolve them, and escalate material or non-negotiable deviations to the DPO.
Evaluate vendor questionnaires, SOC reports, and certifications with Information Security and GRC; assess vendor use of AI, automated decision-making, sensitive data, tracking technologies, and subprocessors.
Manage vendor privacy workflows, evidence, exceptions, remediation plans, and reassessment dates in OneTrust; support vendor offboarding, data return, and deletion.
Track vendor breach-notification obligations and support the Third-Party Incident Response Playbook.
Maintain the enterprise AI inventory and governance tracker, including use cases, risk tiers, assessments, controls, exceptions, remediation, review dates, vendor commitments, and decisions.
Prepare AI impact assessments, disclosures, human-oversight documentation, monitoring records, and incident escalations under applicable requirements.
Research emerging AI laws, enforcement, standards, and guidance; summarize impacts and recommended actions for the DPO.
Maintain AI governance evidence and prepare dashboards, briefings, and escalation materials for the DPO and relevant committees.
Coordinate implementation of DPO-approved AI governance requirements across Legal, Security, Product, Engineering, Procurement, and business teams.
Lead the individual rights workflow in Securiti.ai, including quality review of complex and escalated requests, SLA tracking, metrics, and assistance to the Privacy Analyst I.
Oversee cookie and tracking technology governance with Lokker and Securiti.ai across all brands.
Drive retention and disposal initiatives, including data and physical-records purge activities, under approved retention schedules.
Partner with IT and Security on DSPM, Microsoft Purview, data classification, and DLP, translating privacy requirements into technical specifications.
Support privacy incident response, including breach analysis, state-notification timeline tracking, evidence handling, and post-incident reviews.
Help plan and run privacy tabletop exercises with Legal, IT, Communications, and brand leadership.
Build and maintain privacy KPIs, dashboards, assessment registers, DPA trackers, and audit evidence for leadership, the Data and AI Governance Committee, and auditors.
Monitor changes in state privacy laws, AI laws, and regulatory guidance, and brief the DPO on recommended program changes.
Lead operational integration of subsidiaries into the privacy program under the DPO’s direction, including data-flow mapping, a dedicated DPIA, privacy-notice review, and alignment of vendor, individual-rights, and incident processes.
Prepare analysis for the DPO and Legal on GLBA and FTC Safeguards Rule applicability and state-law exemptions across brands.
Guide and mentor the Privacy Analyst I through work assignments, quality review, and skill development.
Develop and maintain procedures, standards, checklists, templates, and training content, and support the annual privacy training program.
Serve as a working point of contact for Brand Privacy Leads and represent Privacy in cross-functional working groups only as delegated by the DPO.