External Inquiry Lead - Security & Privacy

TikTok USDS Joint Venture; Washington (District of Columbia); On-site; USD 132,000 - 337,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) with company match

Parental leave

Disability insurance

Life insurance

Wellbeing benefits

Paid holidays

Paid sick days

Paid personal time

Job summary

TikTok USDS Joint Venture LLC is seeking a proactive External Inquiry Lead, Security & Privacy to build and scale our external inquiry function from scratch. You will define workflows, triage complex questionnaires, and craft external-ready narratives liaising with Legal, Communications, and engineering teams.

You will shape the trust posture across enterprise deals, aligning with Sales and CGRM to prevent oversharing while ensuring robust security disclosures.

Qualifications

• 7+ years of Information Security, Privacy, IT Audit, TPRM, or Technical Compliance in a complex environment.
• Bachelor's degree in Information Security, CS, Risk Management, or related discipline.
• Strong understanding of 2LoD, data residency, data boundaries, and major frameworks (SOC 2 II, ISO 27001, PCI-DSS, NIST CSF/800-53).
• Exceptional written and verbal communication; ability to translate technical and legal mandates into external docs.
• Ability to work in ambiguous, fast-paced settings and lead initiatives independently.
• Strong PM and collaboration skills across Legal, Communications, Public Policy, Product, and Engineering.

Responsibilities

• Design, build, and scale the External Security & Privacy Inquiry function from ground up with SLAs and governance.
• Lead intake, analysis, drafting, and delivery of complex security and privacy inquiries from clients and government bodies.
• Facilitate cross-functional groups with Legal, Communications, Policy, SMEs, and Business Development on disclosures and responses.
• Create a centralized knowledge base and trust documentation to streamline lifecycles.
• Partner with sales and BD to understand pipelines and deliver tailored trust assurances.
• Collaborate with Engineering and CGRM to leverage AI tools and automated tooling to reduce SME workload.
• Translate evidence, 2LoD controls, and third-party attestations into external narratives.
• Triage inbound inquiries with Global Security, co-manage global architecture questions for unified responses.

Skills

Information Security

Privacy

TPRM

2LoD

Cross-functional leadership

Project management

Communication

Education

Bachelor's degree in Information Security / related field

Tools

AI risk platforms

Job description

Responsibilities About the Team TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on our apps. USDS JV operates a comprehensive data privacy and cybersecurity program under defined safeguards to protect national security and secure U.S. user data, apps, and the algorithm. The USDS Security & Privacy - Compliance, Governance, and Risk Management team is responsible for managing USDS security compliance in accordance with U.S. national security requirements and objectives, providing industry-leading GRC services. Within this function, the External Security & Privacy Inquiry program serves as the primary liaison and front-line defense for external trust assurance. This function owns the end-to-end strategy, intake, cross-functional triage, technical writing, and execution of external security and privacy inquiries from commercial clients, enterprise advertisers, strategic partners, and government entities.

About the Role

TikTok USDS JV is seeking a proactive, highly autonomous, and technical External Inquiry Lead, Security & Privacy. This is a high-visibility, 0 to 1 opportunity to build, scale, and mature our external inquiry and trust assurance function from scratch. You will be responsible for building out a centralized, repeatable workflow to field, triage, and respond to complex compliance and security questionnaires, external vendor and client security assessments, technical architecture deep-dives, and government/regulatory questionnaires. As a primary business enabler, you will bridge the gap between technical security teams, Legal, Communications, Public Policy, and commercial stakeholders—ensuring our external security posture is accurately and consistently communicated while directly supporting the enterprise sales lifecycle and trust profile.

Responsibilities

• Design, build, and scale the USDS JV External Security & Privacy Inquiry function from the ground up, defining response SLAs, escalation paths, cross-functional review frameworks, and quality standards.
• Lead the end-to-end intake, analysis, technical drafting, and delivery of complex external security, privacy, and data boundary inquiries from enterprise clients, advertisers, strategic partners, and government bodies.
• Drive and facilitate cross-functional working groups, aligning with Legal, Communications, Public Policy, Technical SMEs, and Business Development on sensitive disclosures, custom FAQs, and overall response strategies.
• Establish and maintain a centralized knowledge base and customer-facing trust documentation to streamline future inquiry lifecycles and eliminate redundant SME review cycles.
• Partner closely with enterprise sales, business development, and commercial teams to understand deal pipelines, identify security blockers early in the sales lifecycle, and deliver tailored trust assurance that satisfies client security assessments without oversharing sensitive internal IP.
• Collaborate with internal engineering and CGRM teams to leverage AI risk platforms, automated intake tools, and LLM-assisted repository searching to efficiently develop responses and reduce manual administrative overhead on technical SMEs.
• Translate complex technical evidence, 2nd Line of Defense controls, and third-party attestations (e.g., SOC 2, ISO 27001, PCI-DSS) into clear, external-ready narratives.
• Jointly triage inbound inquiries with Global Security counterparts, taking ownership of USDS JV topics while co-managing global architecture questions to deliver unified responses to external stakeholders.

Qualifications

Minimum Qualifications:

• 7+ years of applicable experience in Information Security, Privacy, IT Audit, Third-Party Risk Management (TPRM), or Technical Compliance within a complex, high-growth technology enterprise or highly regulated environment.
• Bachelor's degree in Information Security, Computer Science, Risk Management, Cybersecurity Policy, or a related technical/business discipline.
• Strong foundational understanding of 2nd Line of Defense (2LoD) principles, data residency/sovereignty concepts, data boundaries, network architecture, and major compliance frameworks (SOC 2 Type II, ISO 27001, PCI-DSS, NIST CSF/800-53).
• Exceptional written and verbal communication skills, with a demonstrated ability to translate dense technical architecture and legal/compliance mandates into clear, executive-ready, and defensible external documentation.
• Demonstrated ability to thrive in ambiguous, fast-paced environments, take complete ownership of vague mandates, and build structure, SLAs, and processes independently without hands-on management.
• Strong project management and interpersonal skills, with a proven ability to lead cross-functional working groups and influence stakeholders across Legal, Communications, Public Policy, Product, and Engineering.

Preferred Qualifications:

• One or more industry-recognized certifications: CISA, CDPSE, CISM, CRISC, CISSP, CIPP/US, or PMP.
• Proven track record of independently managing, writing, and executing complex vendor security questionnaires, client security assessments, or regulatory inquiries from end to end.
• Direct experience operating at the intersection of Security/Compliance and Enterprise Sales, with a clear understanding of deal pipelines, commercial SLAs, and customer trust assurance.
• Hands-on experience implementing or utilizing AI-driven questionnaire tools, GRC platforms, or automated data pipelines to streamline compliance operations.

About USDS

TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on the apps we operate. The Joint Venture has been established in compliance with the Executive Order signed by President Trump on September 25, 2025. Our foundation is a comprehensive data privacy and cybersecurity program we operate under defined safeguards to protect national security and secure U.S. user data, apps and the algorithm. We safeguard the U.S. content ecosystem, holding decision-making authority for trust and safety policies and moderation. USDS Joint Venture helps ensure Americans can continue to express their creativity, discover new hobbies and interests, and build thriving communities and businesses on a global scale.

On-site presence across teams allows the company to operate with greater speed, alignment, and agility — especially in areas like real-time decision-making, team development, and integrated execution. As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.

Why Join Us

Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy - a mission we work towards every day.

We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.

Diversity & Inclusion

TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.

USDS Reasonable Accommodation

USDS is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/USDS-RA

Job Information

【For Pay Transparency】 Compensation Description (Annually) - Washington, DC

The base salary range for this position in the selected city is $ 132480 - $ 336960 annually.

Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.

Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).

The Company reserves the right to modify or change these benefits programs at any time, with or without notice.