Location: 100% remote work (Poland)
Workload: Part-time / 0.5 FTE
Working hours: 50% allocation (approx. 4 hours/day) within standard German business hours (09:00-18:00 CET), with a fixed daily schedule and occasional flexibility for ad-hoc project needs
Duration: 6-12 months
Availability: ASAP / within 1 month
About the Role:
We are seeking a highly autonomous Technical Privacy Consultant (Individual Contributor) to support the Product Data Governance team on a short-term loan staff basis. This role focuses entirely on the technical evaluation and operational review of Privacy-by-Design and Privacy-by-Default principles across the product landscape.
The team acts as a consulting partner to product teams, including Product Owners, Data Architects, and System Architects. This position does not involve hands‑on software development, coding, or infrastructure implementation. However, a deep practical understanding of technical privacy controls and their implementation is required to effectively assess architectures and guide developers and architects.
The successful candidate will be a self-starter who can operate with minimal supervision and take full ownership of technical privacy evaluations.
Responsibilities:
- Review and critically assess system architectures, digital products, and data processing workflows across all stages of the product lifecycle to ensure alignment with Privacy-by-Design and Privacy-by-Default principles
- Partner with Product Owners and Architects to translate complex regulatory requirements into technical design concepts, system requirements, and architectural acceptance criteria for engineering teams
- Execute or support Privacy-by-Design assessments and Data Privacy Impact Assessments (DPIA) from a technical perspective
- Identify system‑level privacy and security risks, evaluate architectural weaknesses, and recommend mitigating and compensating controls
- Advise engineering teams on technical privacy solutions, including encryption methods, pseudonymization schemas, data minimization, access governance, and secure transfer protocol design
- Assess architectures to verify compliance with technical requirements related to GDPR, HIPAA, EU Data Act, and EU AI Act
- Act as a technical bridge between Engineering, Legal, Security, Quality, and business functions
- Communicate complex technical privacy risks and negotiate solutions with a wide range of stakeholders
Requirements:
Mindset & Autonomy
- Proven ability to learn quickly, understand complex technical ecosystems, and take ownership of assessments with minimal supervision
- Strong organizational skills and the ability to deliver structured architectural feedback in evolving or loosely defined product environments
- Excellent communication and negotiation skills
- Ability to explain complex technical privacy risks to non-technical stakeholders
- Confidence in challenging senior developers on architectural decisions when required
Technical Knowledge
- 5+ years of experience as a Privacy Architect, Privacy-by-Design Consultant, Technical Privacy Auditor, or in a similar role
- Strong knowledge of GDPR technical implementation, including data minimization, purpose limitation, and security of processing
- Deep understanding of architectures and tools supporting Data Subject Rights (DSR), consent management, and auditability
- Solid understanding of infrastructure segregation, API Gateway hardening, private network tunneling, and browser session hardening
- Practical knowledge of cryptographic segregation, Application-Level Encryption (ALE), secure tokenization, and data lake and analytics protection techniques such as PETs, k-anonymity, and Differential Privacy
- Familiarity with compliance standards such as ISO/IEC 27001 and SOC2 and their integration into technical risk assessments
Certifications:
- CIPT
- CDPSE
- CISSP
- CIPP/E
- CIPM
- CDPO
- Other equivalent technical privacy or security certifications
What This Role Is Not:
- Not a hands‑on software engineering role
- Not a DevSecOps implementation role
- Not a code‑writing position
- Not a legal policy‑writing role
- Focused on technical privacy architecture reviews, identification of privacy gaps, and consulting on mitigation approaches
Language Requirements:
- Fluent English
- German is considered a strong asset but is not required
What We Offer:
- Multisport card
- Private healthcare
- Group life insurance