Principal Compliance Lead, Security (COPPA & GDPR Control Testing)

mrbeastyoutube; United States; Remote; USD 205,000 - 256,000; Full time

Benefits offered by this job

15% bonus

Equity

Medical, dental, vision

401(k) with company match

Job summary

mrbeastyoutube seeks a proven security compliance leader to design and operate a privacy control testing programme. You will translate GDPR, UK GDPR, and COPPA obligations into testable controls, coordinate remediation with technical and legal teams, and prepare the organisation for audits and regulator inquiries.

The role requires a decade in security compliance with at least four years in a senior capacity, plus experience with major privacy standards.

Qualifications

• 10+ years in security compliance, governance, risk, privacy engineering, or technology risk.
• 4+ years in a senior or lead role.
• Experience testing COPPA controls including age screening and consent.
• Working knowledge of GDPR/UK GDPR and their application to engineering and security.

Responsibilities

• Convert privacy and children’s data requirements into specific security controls and run recurring tests.
• Assess controls across apps, websites, SDKs, analytics, advertising, and third‑party integrations.
• Verify safeguards such as age screening, parental consent, data minimisation, retention and deletion, and parental access for users under 13.
• Own security input for data protection by design and security of processing; test related processes for data requests, processing records, retention, and international transfers.
• Contribute to impact assessments and supplier reviews, and keep incident notification processes ready for required deadlines.
• Track issues through resolution with product and engineering owners; report control performance, lead audit and regulator responses, monitor regulatory changes, and coach junior colleagues.

Skills

Security compliance

Governance & risk

Privacy engineering

Auditing

Regulatory liaison

Education

Bachelor's degree or higher

Tools

NIST CSF

ISO 27001/27701

SOC 2

Privacy Framework

Job description

Role overview

Lead the design and operation of a security control testing programme that demonstrates how privacy requirements are applied across digital products used by children, teens, and adults. This senior role translates GDPR, UK GDPR, and COPPA obligations into testable controls, coordinates remediation across technical and legal teams, and prepares the organisation to demonstrate compliance to auditors and regulators.

Responsibilities

• Convert privacy and children’s data requirements into specific security controls, then run recurring tests using sampling, evidence collection, and re-performance.
• Assess controls across apps, websites, software development kits, analytics, advertising, and third-party integrations.
• Verify safeguards such as age screening, parental consent, data minimisation, retention and deletion, and parental access for users under 13.
• Own security input for data protection by design and security of processing; test related processes for data requests, processing records, retention, and international transfers.
• Contribute to impact assessments and supplier reviews, and keep incident notification processes ready for required deadlines.
• Track issues through resolution with product and engineering owners; report control performance, lead audit and regulator responses, monitor regulatory changes, and coach junior colleagues.

Requirements

• At least 10 years in security compliance, governance, risk, privacy engineering, or technology risk, including 4 or more years in a senior or lead role.
• Practical experience testing COPPA controls, including age screening, consent, and handling children’s data.
• Working knowledge of GDPR and UK GDPR as they apply to engineering and security, including Articles 25, 30, 32, 33, and 35.
• Ability to translate legal requirements into testable controls and operate a documented, audit-ready testing programme.
• Experience with at least one of NIST CSF or Privacy Framework, ISO 27001/27701, or SOC 2.
• Understanding of cloud, mobile, and web data flows, identity and access management, encryption, logging, and retention; relevant degree or equivalent experience.

Nice to have

• Experience with consumer services used by young audiences, including media, gaming, education technology, or financial products.
• Familiarity with COPPA Safe Harbor programmes, the UK Age-Appropriate Design Code, consent or data-mapping tools, and data-subject-request automation.
• Relevant privacy, audit, or security certifications, or experience responding to regulatory inquiries.

Benefits and work setup

• Base compensation of $205,000-$256,000, plus a 15% bonus and equity.
• Medical, dental, vision, life insurance, health savings account contributions, and a 401(k) with company match.
• Flexible vacation, paid holidays, and company-provided technology; relocation assistance may include travel and housing for the first 90 days.