Regulatory Compliance Program Manager

MongoDB Inc.; Ireland; On-site; EUR 90,000 - 130,000; Full time

Job summary

MongoDB Inc. seeks a Regulatory Change Management Program Manager to anticipate regulatory developments in technology, cyber security and AI, assess implications, and ensure obligations are identified and addressed before risk arises.

You will partner across ARC, Privacy, Legal, Product, and Engineering to deliver concise impact assessments and escalation when needed. You will monitor evolving requirements, maintain a forward-looking change inventory, coordinate across SMEs, and create

Qualifications

• Practical knowledge of GDPR and UK GDPR, including lawful processing, accountability, data minimisation, transfers, retention, and individual rights
• Five or more years of experience in regulatory change management in compliance, privacy, or a closely related discipline
• Experience supporting regulatory change management, horizon scanning, obligations management, or compliance impact assessments
• Excellent written communication skills, including the ability to produce concise briefings, evidence-based recommendations, and documentation for technical and non-technical audiences
• Exposure to DORA, NIS2, the EU AI Act, ePrivacy requirements, digital-services regulation, or comparable technology regulation
• A proactive, questioning mindset: you look for what could be missed, what has changed, who is affected, and what evidence would change the conclusion
• Understanding of data classification, information governance, records management, or data-handling frameworks
• Ability to work independently, exercise sound judgement, and escalates appropriately when ownership, applicability, or risk is unclear
• Strong stakeholder-management and collaboration skills, with the confidence to work across Legal, Privacy, Security, Engineering, Product, Procurement, People, and customer-facing teams
• Strong analytical and problem-solving skills, with the ability to distinguish material risk from noise and draw clear conclusions from incomplete information
• High attention to detail and strong organisational skills, including the ability to manage multiple priorities, deadlines, dependencies, and follow-ups
• Experience working with in-house legal teams to interpret laws, regulations, regulatory guidance, or contractual requirements and translating them into obligations, applicability assessments, risks, and decisions
• Experience in a technology, SaaS, cloud, platform, or other highly regulated environment
• Familiarity with information-security and assurance frameworks such as ISO 27001, SOC 2, NIST CSF, or the Cloud Security Alliance controls
• Experience working with regulatory inventories, GRC platforms, privacy-management tools, data catalogues, or workflow systems
• A relevant qualification such as CIPP/E, CIPM, CIPT, IAPP FIP, CISA, CRISC, or an equivalent professional credential

Responsibilities

• Monitor regulatory developments across data protection, privacy, cybersecurity, AI, and online services
• Maintain regulatory change inventory with sources, dates, applicability, affected business areas, accountable stakeholders, and status
• Collaborate with legal to assess relevance to MongoDB’s products, services, entities, customers, suppliers, workforce, or operating model
• Prepare impact assessments, obligation summaries, briefing notes, and escalation papers for senior stakeholders within ARC and Global Security Organization
• Coordinate regulatory change assessments across subject-matter experts
• Track decisions, dependencies, risks, and overdue responses; identify unclear ownership or interpretation
• Surface emerging themes and potential blind spots
• Data-protection and data-classification: collaborate with Security, Privacy and Legal on GDPR/UK GDPR analysis across products and processes
• Advise teams from Compliance on classification decisions for information in internal systems and customer engagements
• Develop dashboards and reporting showing exposure, readiness, ownership, overdue decisions, and material trends
• Support internal compliance requests and regulatory enquiries by coordinating evidence and explanations
• Contribute to policies, standards, playbooks, and training content where regulatory interpretation is required

Skills

Regulatory change mgmt

Data protection

Stakeholder management

Analytical thinking

Written communication

Cross-functional collaboration

Regulatory horizon scanning

Education

CIPP/E

CIPM

CRISC

Tools

GRC platforms

Job description

• MongoDB is seeking a Regulatory Change Management Program manager to help anticipate regulatory developments within Technology, Cyber Security and AI spaces, assess their implications for the business, and ensure material obligations are identified and addressed before they create unexpected risk or exposure
• This role reports to the Director of Operations within MongoDB’s Assurance, Risk & Compliance (ARC) team
• You will monitor the regulatory environment, assess applicability and compliance impact, and give the ARC team a clear view of emerging obligations, exposure, and readiness
• In addition to working within ARC, you will work across Privacy, Legal, Product, Engineering, People, and other business teams, providing the insight, interpretation, and escalation that help accountable owners respond early and proportionately
• Regulatory horizon scanning and change management:
• Monitor and triage developments in data protection, privacy, cybersecurity, digital resilience, artificial intelligence, online services, and other regulations relevant to MongoDB
• Maintain a forward-looking regulatory change inventory, including source, effective date, applicability, affected business areas, accountable stakeholders, and current assessment status
• Collaborate with legal to assess whether a regulatory development is relevant to MongoDB’s products, services, entities, customers, suppliers, workforce, or operating model
• Prepare concise impact assessments, obligation summaries, briefing notes, and escalation papers for senior stakeholders within ARC group and Global Security Organization
• Coordinate regulatory change assessments across subject-matter experts
• Track decisions, dependencies, risks, and overdue responses; identify where ownership or interpretation is unclear
• Surface emerging themes and potential blind spots
• Data protection and Data classification:
• Collaborate with the Security team, the Privacy and Legal teams with GDPR and related data-protection analysis across products, business processes, and third-party relationships
• Escalate potential compliance gaps, or unresolved interpretation questions
• Help maintain and evolve a practical data-classification framework aligned to regulatory, security and business requirements
• Advise teams from Compliance perspective on classification decisions for information used in internal systems, customer engagements, and third-party services
• Review Compliance related classification challenges and exceptions for consistency, proportionality, and traceability
• Oversight, reporting, and assurance:
• Develop dashboards and reporting that show exposure, readiness, ownership, overdue decisions, and material trends rather than activity for its own sake
• Support internal compliance requests, regulatory enquiries, and control assessments by coordinating evidence and explaining the basis for conclusions
• Contribute to policies, standards, playbooks, and training content where regulatory interpretation or risk context is required
• What success looks like:
• Leaders receive early, decision-useful insight into regulatory developments that could affect MongoDB
• Regulatory changes have a clear applicability assessment, accountable owner, documented rationale, and visible next step
• Data-classification questions are answered consistently, with uncertainty and residual risk made explicit
• The organisation can distinguish between a confirmed obligation, an interpretation requiring legal advice, an implementation task, and an unresolved risk
• Audits, customer reviews, and regulatory conversations are supported by current evidence and a clear explanation of how conclusions were reached
• Teams are less likely to be surprised by new obligations, missed dependencies, unclear ownership, or unsupported compliance claims

Qualifications and Experience

• Practical knowledge of data-protection principles, especially GDPR and UK GDPR, including lawful processing, accountability, data minimisation, transfers, retention, and individual rights
• Five or more years of experience in regulatory change management in compliance, privacy, or a closely related discipline
• Experience supporting regulatory change management, horizon scanning, obligations management, or compliance impact assessments
• Excellent written communication skills, including the ability to produce concise briefings, evidence-based recommendations, and documentation for technical and non-technical audiences
• Exposure to DORA, NIS2, the EU AI Act, ePrivacy requirements, digital-services regulation, or comparable technology regulation
• A proactive, questioning mindset: you look for what could be missed, what has changed, who is affected, and what evidence would change the conclusion
• Understanding of data classification, information governance, records management, or data-handling frameworks
• Ability to work independently, exercise sound judgement, and escalates appropriately when ownership, applicability, or risk is unclear
• Strong stakeholder-management and collaboration skills, with the confidence to work across Legal, Privacy, Security, Engineering, Product, Procurement, People, and customer-facing teams
• Strong analytical and problem-solving skills, with the ability to distinguish material risk from noise and draw clear conclusions from incomplete information
• High attention to detail and strong organisational skills, including the ability to manage multiple priorities, deadlines, dependencies, and follow-ups
• Experience working with in-house legal teams to interpret laws, regulations, regulatory guidance, or contractual requirements and translating them into obligations, applicability assessments, risks, and decisions
• Experience in a technology, SaaS, cloud, platform, or other highly regulated environment
• Familiarity with information-security and assurance frameworks such as ISO 27001, SOC 2, NIST CSF, or the Cloud Security Alliance controls
• Experience working with regulatory inventories, GRC platforms, privacy-management tools, data catalogues, or workflow systems
• A relevant qualification such as CIPP/E, CIPM, CIPT, IAPP FIP, CISA, CRISC, or an equivalent professional credential