Sr. Privacy Compliance Analyst

Groq•San Francisco, CA

5d•$154,900 - $208,700•Onsite

About The Position

Groq is seeking a Sr. Privacy Compliance Analyst to own day-to-day privacy operations. This role manages the privacy controls in our compliance program and is responsible for operational readiness, while Legal remains responsible for legal determinations. The position is located in or near the SF Bay Area, New York City, and Dallas.

Requirements

5+ years in privacy compliance or privacy risk management, including hands-on operationalisation of privacy regulations across business functions.
Experience conducting regulatory impact assessments for emerging privacy and AI or automated decision-making laws: applicability, business impact, implementation requirements and operational readiness.
Experience building and applying a risk-based compliance monitoring methodology, and overseeing PIAs and DPIAs for quality, data classification and supporting evidence.
Experience maturing privacy governance through metrics and reporting (KRIs, KCIs, KPIs) and presenting privacy risk posture to leadership.
Experience supporting privacy incident investigations and control testing; comfortable partnering with Legal and knowing which questions belong to them.
This position may require access to technology and/or information subject to U.S. export control laws and regulations, including the Export Administration Regulations (EAR). To comply with these requirements, candidates for this role must meet certain citizenship or residency criteria. Specifically, they must qualify as U.S. Persons for export control purposes (i.e., U.S. citizen, U.S. lawful permanent resident (Green Card holder), or a protected individual under 8 U.S.C. § 1324b(a)(3) such as a refugee or asylee), or otherwise be eligible for an applicable export license.

Nice To Haves

Experience with GRC tooling preferred.
CIPM, CIPP/E or equivalent IAPP certification.

Responsibilities

Own closure and ongoing maintenance of privacy controls in GRC system and privacy rights requests in Datagrail or similar tool.
Maintain the obligations library of legal, regulatory and contractual privacy obligations mapped to controls and owners, including incoming regulation and a written operational position per requirement.
Operate the privacy rights request process (access, deletion, correction, objection) within statutory deadlines, from intake and identity verification through fulfilment and record keeping.
Report privacy posture and the regulatory horizon to security leadership monthly.