VP - Privacy Compliance

As a Vice President in the Compliance, Conduct, and Operational Risk (CCOR) Data & AI team, you will be part of an innovative and talented team providing second line oversight and challenge of the Firmwide Privacy Office. This role reports to the CCOR Global Privacy & Data Use Lead and is part of a team of SMEs that provides firmwide second line privacy and data use risk coverage, driving compliance and operational risk management at scale.

This position requires deep subject matter expertise in privacy, and experience advising stakeholders and counterparts on the implementation and governance of key privacy laws, rules, regulations, and principles. The role provides vertical coverage and horizontal support on the most material, complex, and novel privacy risk matters across the firm’s Lines of Business, Corporate Functions, and Regionally-aligned CCOR teams to supply comprehensive independent 2LOD advice and oversight of 1LOD business and functional activities.

Job Responsibilities:

• Provide independent 2LOD oversight and credible challenge of 1LOD privacy risk management activities, including incident management, PIAs, control design/testing, governing documentation, and issue identification/remediation.
• Conduct risk-based coverage and thematic reviews of 1LOD privacy processes and controls; document observations, challenges, and required corrective actions through established issue and action-plan governance.
• Define and monitor risk metrics (KRIs and KPIs) and deliver clear, metrics-driven reporting and timely escalation to senior management on material privacy risks, control gaps, incidents, emerging themes, and overdue remediation actions.
• Develop and maintain 2LOD privacy compliance policies; review and challenge 1LOD standards and procedures for alignment and effective operationalization.
• Monitor the regulatory environment and independently assess impact of new/changed privacy requirements; challenge 1LOD implementation plans and control updates and track remediation to completion.
• Assess and challenge privacy risk impacts from emerging internal/external drivers, including material process changes, significant incidents/events, third-party/vendor changes, and new products/data uses.
• Provide 2LOD oversight and credible challenge for emerging-technology use cases impacting personal data (including AI/ML); ensure evolving regulatory expectations and minimum control requirements are embedded into delivery and ongoing monitoring.
• Support privacy-related regulatory exams and supervisory engagements by coordinating and reviewing responses/submissions and providing independent risk perspective on remediation commitments.
• Advise on, develop, and deliver privacy training and awareness; identify training needs, define content expectations and target audiences, create/update course materials, partner with stakeholders to address gaps and drive continuous improvement.
• Provide high-value, practical independent risk advice and credible challenge to the Firmwide Privacy Office, CCOR leadership, and key stakeholders on complex, material, and novel privacy risk matters.

Sustained delivery of impact in the above duties will result in development of important skills and create opportunities for career progression and promotion.

Required qualifications, capabilities, and skills

• 5 years of experience in privacy compliance/risk, data risk management, or audit.

• Experience in the Financial Services Sector developing and maintaining privacy- and/or data-related policies/standards/procedures, control expectations, training/awareness materials, management reporting, and regulator-facing documentation.

• Knowledge of key privacy laws and regulatory expectations (e.g., GDPR, GLBA, CCPA) and ability to monitor and assess emerging requirements impacting data use and AI.

• Demonstrated ability to work independently and manage relationships across businesses, functions, and regions, including technology, product, data governance, and risk stakeholders.

• Excellent analytical, problem-solving, and communication skills, including the ability to synthesize complex topics (privacy technology risk) into clear executive-level messages.
• Demonstrated intellectual curiosity, capability to learn quickly and ability to prioritize and manage multiple competing demands across a global business.
• Experience with, or demonstrated ability to learn, risk management principles and techniques, including providing oversight and credible challenge to assessments of risk and control environments and second line of defense coverage activities.

• Highly motivated, energetic self-starter who takes ownership and manages deliverables with a strong attention to detail and completes deliverables in a timely manner.