Compliance Director

Waterstone Human Capital; United States; Remote; USD 150,000 - 230,000; Full time

Benefits offered by this job

100% remote

Healthcare: 100% premiums covered

401(k) match

Unlimited PTO

Job summary

Waterstone Human Capital is seeking a Compliance Director to own the end-to-end TCPA and privacy program from the CEO’s office. This 100% remote role requires US-based candidates and reports directly to the CEO.

You will define policy, lead audits, and build systems for a fast-growing performance marketing network. The role emphasizes turning regulatory trends into actionable business guidance, balancing aggressive growth with legal risk, and partnering with outside counsel to shape company-wide

Qualifications

• 7+ years of compliance experience in performance marketing.
• Deep TCPA expertise and ongoing regulatory monitoring.
• Ability to write for executives with clear recommendations.

Responsibilities

• Own TCPA compliance program and updates.
• Audit publisher network and traffic sources.
• Partner with leadership to embed compliance in product design.
• Train non-legal staff on compliance topics.

Skills

TCPA expertise

Compliance experience

Executive communication

CAN-SPAM knowledge

Education

Bachelor’s degree

Tools

TrustedForm

Jornaya

LashBack

Optizmo

Job description

This is a chance to own compliance end to end at a fast‑growing performance marketing company, reporting directly to the CEO. You won’t be a gatekeeper. You’ll be the TCPA expert the business trusts to say “not like that, but here’s how,” and you’ll have real authority where the answer has to be no. If you’ve spent years in lead gen compliance and want to build the function your way, this is that seat.

Position Overview

This is a remote, full‑time position, and the hire must be based in the United States.

The Compliance Director owns the compliance function and reports directly to the CEO.

The company runs a network of owned and operated consumer properties across sweepstakes, free samples, giveaways, rewards, surveys, and job search. They’re monetized through publisher and advertiser relationships. That model sits in the most active area of consumer protection regulation in the country. TCPA is the center of gravity, and the rules keep moving: consent standards, revocation and quiet hours requirements, a growing patchwork of state mini‑TCPA statutes, and ongoing FCC rulemaking. The Compliance Director sees those changes coming and gets the business positioned before they land.

Today, compliance work is spread across outside counsel and several people whose main job is something else. Written policies exist and some tooling is in place, but no one owns the function end to end. This role brings all of it under one owner, raises the standard, and builds the systems that let one person cover a company of this size.

This is a standalone function. You will be the compliance team, working directly with outside counsel, the publisher and advertiser teams, and executive leadership.

The Part That Matters Most

The hardest and most valuable part of this job is holding a high compliance standard while still helping the business get where it wants to go. That takes understanding the revenue model well enough to engineer a compliant path, and having the credibility to make it stick. There are also categories where the answer is no and it doesn’t move, and this role has hard authority there. Knowing which situation you’re in, and being right about it, is the core skill.

Primary Responsibilities

TCPA Expertise and Regulatory Horizon Scanning

• Serve as the company’s subject matter expert on TCPA.
• Stay current on FCC rulemaking and orders, consent and revocation rules, quiet hours, court decisions, and enforcement trends.
• Track the expanding state mini‑TCPA landscape, including Florida, Oklahoma, Maryland, and each new statute.
• Monitor pending legislation and rulemaking, and flag early what it means for consent flows, publisher requirements, and buyer integrations.
• Extend the same monitoring to CAN‑SPAM, FTC activity, state privacy legislation, and prize promotion law.
• Translate all of it into plain‑language summaries for leadership, each with a recommendation.

Lead Generation and Affiliate Risk

• Own risk mitigation across path to consent, disclosure placement, partner‑sourced traffic, co‑registration flows, data pass and downstream buyer obligations, incentivized traffic, and affiliate creative.
• Define and maintain a risk tier framework that separates hard‑authority categories from business‑owned calls.
• Run internal audits and maintain a key risk register and mitigation plan.
• Monitor business operations against company policies.

Business Partnership and Risk Judgment

• Work with business leaders early, so compliance is a design input rather than a late veto.
• When something can’t be done as proposed, find and propose the version that can.
• Learn the revenue model, traffic sources, and monetization well enough to weigh business cost against regulatory risk.
• Escalate unresolved hard‑tier disagreements to the CEO with the risk, the impact, and a recommendation.

Publisher and Partner Compliance

• Proactively audit the publisher network on a set schedule, using internal tools and third‑party monitoring platforms.
• Audit creative usage, opt‑in and consent practices, sending domains, traffic sourcing, and adherence to agreements and policies.
• Drive publisher issues to closure with Publisher Account Management, Operations, Analytics, and Engineering.
• Maintain a tracked log of open publisher issues and report on it monthly.
• Own the vetting and approval framework for new publishers, traffic sources, and advertisers.
• Own lead certification and verification tooling such as TrustedForm and Jornaya.
• Partner with Analytics and Operations on traffic quality and fraud signals.

Policy Ownership and Training

• Own existing written policies, assess them against current law, and update them with outside counsel.
• Own site‑facing legal collateral, including privacy policies, terms, consent language, and official sweepstakes rules.
• Train employees on compliance topics on a recurring cadence, in a way that lands with non‑compliance staff.
• Run a monthly compliance meeting and prepare status reports for executive management.

Consent Architecture and Privacy

• Own consent architecture across consent flows, publisher practices, and buyer integrations.
• Own the consumer privacy program end to end, including DSAR intake, fulfillment, and downstream deletion notices.
• Maintain compliance with CCPA, CPRA, and new state privacy frameworks.
• Maintain internal DNC and suppression processes, and monitor email and SMS compliance.

Administration and Vendor Ownership

• Manage consumer complaints and pre‑litigation demands with outside counsel.
• Maintain state registrations and licenses, including data broker registrations, telemarketing licenses, sweepstakes registration and bonding, and entity filings.
• Serve as business owner for compliance software and data vendors.
• Build an environment where raising a compliance concern is expected, not discouraged.

Required

Candidate Overview

• Deep, current TCPA expertise. You can explain where the consent rules landed, what state mini‑TCPAs require, and what’s coming next, without looking it up.
• A habit of following TCPA developments as they happen.
• 7+ years of compliance experience in performance marketing, lead generation, or affiliate marketing.
• Proven ability to hold a high standard while finding workable paths for the business. Expect to share examples of both.
• Working knowledge of where risk concentrates in partner‑sourced traffic, plus hands‑on experience mitigating it.
• Experience auditing third‑party publishers or traffic partners.
• Experience drafting or materially shaping compliance policies with legal counsel.
• Hands‑on experience with TrustedForm, Jornaya, LashBack, Optizmo, or similar.
• Working knowledge of CAN‑SPAM and state privacy law (CCPA/CPRA and successors).
• Experience building and running a DSAR or consumer privacy request program.
• A track record of training non‑legal audiences and getting real adoption.
• The ability to write for executives: short, clear, and opinionated, with a recommendation.
• Comfort using AI tools to work faster.
• A bachelor’s degree or equivalent experience.

Nice to Have

• Sweepstakes, promotions, rewards, or survey vertical experience.
• Prize promotion law, official rules drafting, and state registration and bonding.
• OneTrust or a similar privacy platform.
• Call center quality and compliance monitoring.
• CIPP/US, CIPM, or a comparable certification.
• Experience consolidating a scattered compliance function or building one from scratch.
• Active participation in industry compliance groups.

Company Overview

The company is a fast‑growing performance marketing business built on an internally owned and operated network of web properties and exclusive first‑party data. It connects major brands with their ideal consumers through an audience‑centric, omni‑channel approach, and it has seen triple‑digit growth over the past several years.

Why Join

• 100% remote: Laptop, monitors, and internet are provided.
• Health care covered: The company pays 100% of health, dental, and vision premiums, plus maternity leave.
• Great Place to Work Certified: Based entirely on employee feedback.
• Compensation and time off: Competitive pay, a 401(k) match, and unlimited PTO.

Core Values

• Creative: Generates new, out‑of‑the‑box ideas.
• Communicative: Builds and maintains strong business relationships.
• Adaptable: Adjusts to changing priorities, sometimes daily.
• Resourceful: Solves unstructured problems with little supervision.
• Team Player: Builds collaborative relationships with peers.