Global Data Privacy & AI Lead

Forward Air Corporation; Ciudad de México; On-site; MXN 2,259,000 - 3,389,000; Full time

Job summary

Forward Air Corporation seeks a senior Global Data Privacy & AI Lead to design, implement, and operate the company’s global privacy and data protection program while advancing the AI governance framework in coordination with the AI Governance Committee and Technical Working Group.

The role serves as the principal SME on data privacy, data protection, and AI regulatory risks, requiring deep regulatory fluency and autonomous execution to influence stakeholders across Legal, IT, Security,

Qualifications

• Bachelor’s degree in law, compliance, privacy, information governance, cybersecurity, information systems, or related field.
• At least 10 years of privacy, data protection, compliance, or regulatory advisory experience.
• Deep knowledge of GDPR, CCPA/CPRA, HIPAA, and emerging AI laws and governance.

Responsibilities

• Design and mature the company’s privacy and data protection program across global regions.
• Administer AI governance, including policies, inventories, risks, and guidance.
• Lead privacy risk assessments (DPIAs, PIAs, TIAs) and data-mapping activities.

Skills

GDPR knowledge

DPIA leadership

AI governance

Cross-functional collaboration

Education

Law degree

Tools

OneTrust

Microsoft Purview

Job description

The Global Data Privacy & AI Lead is a senior expert role responsible for designing, implementing, and independently operating the Company’s global privacy and data protection program, while leading the day-to-day administration and continued development of the Company’s AI governance framework in coordination with the AI Governance Committee and Technical Working Group. The role has a strong emphasis on the General Data Protection Regulation (GDPR), U.S. state privacy laws, the Health Insurance Portability and Accountability Act (HIPAA), and emerging international privacy and AI regimes.

The role serves as the principal subject-matter expert on data privacy, data protection, and AI-related regulatory and compliance risks. It is a hands-on individual contributor position requiring deep technical and regulatory fluency, sound judgment, and the ability to operate autonomously while influencing stakeholders across Legal, IT, Information Security, Engineering, HR, Procurement, Operations, Internal Audit, and the broader business.

Key Responsibilities

• Design, implement, and continuously mature Forward Air’s company-wide privacy and data protection program in alignment with GDPR, CCPA/CPRA, HIPAA, and emerging global privacy regulations.
• Own the development, implementation, and maintenance of privacy governance elements and administer the operational components of the Company’s AI governance framework, including policies, standards, standard operating procedures, records of processing activities, AI inventories, risk-classification processes, and internal guidance.
• Independently lead privacy risk assessments, including data protection impact assessments, transfer impact assessments, data-mapping exercises, data-subject rights workflows, and third-party privacy reviews, using scalable and programmatic approaches.
• Identify, assess, document, and support the mitigation of privacy and AI-related risks associated with data flows, analytics, automation, AI-enabled systems, vendors, and cross-border data transfers.
• Advise on responsible AI, automated decision-making, and advanced analytics, translating applicable legal, regulatory, ethical, and governance expectations into practical operational controls.
• Administer the AI-use-case intake, inventory, risk-classification, assessment, monitoring, and escalation processes; coordinate cross-functional review through the Technical Working Group; and prepare material, high-risk, or exception matters for AI Governance Committee consideration.
• Partner with IT, Information Security, Engineering, HR, Procurement, and business teams to embed privacy-by-design, security-by-design, transparency, proportionality, and data-minimization principles into systems, workflows, procurement processes, and product or service lifecycles.
• Define privacy and AI governance requirements and partner with accountable business, technology, records, and security owners to implement and mature controls covering data retention, deletion, access management, consent and preference management, data classification, data sharing, and third-party integrations.
• Serve as the primary privacy compliance lead for regulatory inquiries, audits, customer assessments, and applicable assurance or certification activities, including relevant privacy criteria under SOC 2, ISO/IEC 27701, and HIPAA-related reviews, where applicable, ensuring audit readiness and timely, coordinated responses.
• Collaborate with Internal Audit, Ethics & Compliance, Legal, and Information Security to assess control effectiveness, support remediation of identified gaps, and track privacy and AI governance program maturity and risk trends.
• Provide expert privacy and compliance guidance on incident preparedness and response, including supporting breach-notification analysis, data-subject communications, and regulatory engagement, in coordination with Legal and Information Security.
• Act as a trusted advisor to senior leadership on evolving privacy, AI, and data-governance risks, translating regulatory and market developments into actionable business guidance.
• Develop and deliver targeted privacy and AI governance training and awareness programs for employees and relevant third parties to promote ethical data use, responsible AI practices, and accountability.
• Define and implement scalable monitoring, reporting, evidence-collection, and recordkeeping mechanisms by leveraging privacy and governance, risk, and compliance tools, dashboards, workflows, and automation.
• Maintain current knowledge of global legal and regulatory developments, enforcement trends, industry standards, and emerging risks, and proactively advise on their potential impact on Forward Air’s operations.
• Support adjacent ethics, compliance, technology-governance, and regulatory initiatives as reasonably required, demonstrating flexibility and the ability to respond to evolving business and risk priorities.

Required Qualifications

• Bachelor’s degree in law, compliance, privacy, information governance, cybersecurity, information systems, or a related field, or equivalent relevant professional experience.
• At least 10 years of relevant experience in privacy, data protection, compliance, legal, information governance, or regulatory advisory roles, including experience operating in a complex or multinational environment.
• Deep, hands‑on knowledge of GDPR, CCPA/CPRA and other U.S. state privacy laws, HIPAA, and comparable international privacy frameworks, together with working knowledge of emerging AI laws and governance expectations.
• Proven ability to build, implement, and independently operate a privacy program and to administer cross‑functional AI governance processes without reliance on a large dedicated team.
• Strong understanding of how privacy and AI governance requirements translate into technical and operational controls, including data flows, access management, retention and deletion, third‑party integrations, automated decision‑making, and model or system monitoring.
• Demonstrated experience leading DPIAs, PIAs, TIAs, data mapping, data‑subject rights processes, vendor privacy reviews, incident‑response support, and regulatory or audit readiness activities.
• Ability to identify, prioritize, communicate, and support resolution of complex privacy and AI‑related risks while preserving clear ownership and escalation paths across Legal, Information Security, IT, and business functions.
• Exceptional judgment, discretion, and integrity when handling sensitive, confidential, or legally protected information.
• Excellent written and verbal communication skills, with the ability to translate complex legal, regulatory, and technical requirements into practical guidance for technical and non‑technical audiences and to influence senior stakeholders without direct authority.
• Strong execution discipline, organizational rigor, and comfort operating autonomously in an evolving and sometimes ambiguous environment.
• Willingness to travel occasionally based on business needs.

Preferred Qualifications

• Privacy, AI governance, compliance, audit, or information‑security certification, such as CIPP/US, CIPP/E, CIPM, AIGP, CCEP, CISA, CISM, CRISC, or an equivalent credential.
• Experience with privacy, AI governance, and governance, risk, and compliance platforms, such as OneTrust, Microsoft Purview, or comparable workflow and evidence‑management tools.
• Experience with AI, machine learning, generative AI, automation, advanced analytics, or automated decision‑making from a governance, privacy, legal, compliance, risk, or assurance perspective.
• Familiarity with privacy and AI‑related standards and assurance frameworks, including ISO/IEC 27701, ISO/IEC 42001, the NIST Privacy Framework, the NIST AI Risk Management Framework, and SOC 2 privacy criteria.
• Experience in transportation, logistics, or another regulated, global, operationally complex, or highly data‑driven environment.
• Juris Doctor or comparable legal qualification is advantageous where the role is expected to provide legal advice, but is not required for a privacy and AI governance lead position.