Privacy & AI Governance Analyst

Vasion; Lehi (UT); On-site; USD 110,000 - 160,000; Full time

Benefits offered by this job

Flexible work environment

Vacation Bonus

Flexible paid time off

Paid parental leave

Competitive pay

Training/Advancement opportunities

401k with company match

HSA

On-site gym & amenities

Job summary

Vasion seeks a Privacy & AI Governance Analyst to own the execution of privacy and AI governance. You will lead end-to-end DPAs, DPIAs, and policy updates, working across Product, Engineering, Security, Sales, Marketing, HR, and Legal.

You will drive data mapping, training, and vendor risk assessments while supporting HIPAA considerations as the company scales internationally. This role is hands-on and independent from day one.

Qualifications

• 3–5 years in privacy, compliance, or legal ops at tech or SaaS.
• Working knowledge of GDPR/CCPA and practical privacy program ops.
• Experience reviewing, redlining, negotiating DPAs.
• Exposure to AI governance, ISO 42001, or EU AI Act is a plus.
• Ability to manage multiple compliance workstreams with discipline.
• CIPP/US, CIPP/E, or CIPM in progress or held preferred.
• Experience with privacy GRC or consent tools (OneTrust, MineOS, Osano) is a plus.

Responsibilities

• Own end-to-end DPA review, redline and execution process with authority.
• Manage DSR intake, response, and tracking across GDPR/CCPA.
• Conduct Privacy Impact Assessments for new features and processing.
• Maintain subprocessor register and vendor compliance notifications.
• Lead cookie consent management in partnership with Product/Engineering.
• Own privacy policy maintenance and web publication coordination.
• Manage GDPR and US data privacy framework obligations.
• Support privacy obligations across Germany, UK, Australia entities.
• Lead data mapping and privacy GRC tool deployment.
• Deliver GDPR and privacy training to internal teams.
• AI governance: maintain model inventory, bias testing docs.
• Draft and maintain Responsible AI Use Policy and guidance.
• Support ISO 42001 certification maintenance and audits readiness.
• Monitor EU AI Act and US state AI legislation for applicability.
• Provide operational support to AI Governance Committee.
• Conduct AI vendor risk assessments with Security/Procurement.

Skills

Privacy program execution

AI governance

DPA negotiation

GDPR & CCPA

Policy drafting

Privacy GRC tools

CIPP/CIPM in progress

Vendor management

Tools

OneTrust

MineOS

Osano

Job description

About the role

As Privacy & AI Governance Analyst at Vasion, you will own the execution of our privacy program and AI governance framework, two of the company’s highest-externally-visible compliance domains. This is a hands-on builder role, not a coordinator role. You will inherit programs in motion and be expected to run them independently from day one. You will report directly to the General Counsel & Chief Compliance Officer and serve as the company’s subject matter expert on all things privacy and AI governance. You will work cross-functionally with Product, Engineering, Security, Sales, Marketing, HR, and Legal to embed compliance into how Vasion builds and operates. You will also support Vasion’s obligations as a group health plan sponsor as the company transitions toward a self-funded insurance model. This role is an opportunity to build privacy and AI governance infrastructure at a company in a genuine market moment, where FedRAMP authorization, ISO 42001 certification, and a growing federal customer base make compliance a strategic differentiator, not a back-office function.

What you’ll do

• Own the end-to-end DPA review, redline, and execution process - with authority to approve standard customer DPAs without escalation
• Manage data subject rights (DSR) intake, response, and tracking across GDPR, CCPA, and applicable US state privacy laws
• Conduct Privacy Impact Assessments (PIAs) for new product features, integrations, and data processing activities
• Maintain and update the subprocessor register and manage vendor subprocessor compliance notifications
• Lead cookie consent management implementation in partnership with Product and Engineering
• Own privacy policy maintenance, including coordinating updates with Marketing and ensuring accurate web publication
• Manage Vasion’s EU-US Data Privacy Framework compliance obligations
• Support international privacy obligations across Vasion’s Germany, UK, and Australia entities
• Lead data mapping and privacy GRC tool deployment (active evaluation in progress)
• Deliver GDPR and privacy training to internal teams

AI Governance Program Execution

• Maintain Vasion’s AI model inventory, bias testing documentation, and audit trail records
• Draft and maintain the Responsible AI Use Policy and supporting internal guidance
• Support ongoing ISO 42001 certification maintenance and internal audit readiness
• Monitor EU AI Act and US state-level AI legislation and assess applicability to Vasion’s product and operations
• Provide operational support to the AI Governance Committee, coordinating with the CIO and cross-functional members
• Conduct AI vendor risk assessments in partnership with Security and Procurement

Policy Development & Training

• Own the compliance policy library - drafting, maintaining, versioning, and publishing policies across domains
• Design and deliver privacy and AI governance training programs for internal teams
• Develop plain-language compliance guidance for Engineering, Marketing, Sales, and HR
• Support Sales with privacy and AI compliance questionnaire responses and Trust Center content

HIPAA Group Health Plan Support

• Support Vasion’s HIPAA obligations as a group health plan sponsor through the transition from level-funded to self-funded coverage
• Assist with Business Associate Agreement (BAA) management, workforce training coordination, and breach notification procedures
• Maintain HIPAA Privacy and Security Policies & Procedures in coordination with the CCO as Security Official

Qualifications

• 3-5 years of experience in a privacy, compliance, or legal operations role - ideally at a technology or SaaS company
• Working knowledge of GDPR and CCPA and the practical mechanics of running a privacy program (not just regulatory familiarity)
• Experience reviewing, redlining, and negotiating Data Processing Agreements (DPAs)
• Exposure to AI governance frameworks, ISO 42001, or EU AI Act compliance is a meaningful plus
• Demonstrated ability to execute across multiple compliance workstreams simultaneously without losing detail or deadline discipline
• Strong written communication - you can write a policy people actually read and a training people actually learn from
• Comfort building in ambiguity - many of the processes you will own are in progress or not yet formalized
• CIPP/US, CIPP/E, or CIPM certification held or actively in progress preferred
• Experience with privacy GRC or consent management tools (OneTrust, MineOS, Osano, or similar) is a plus
• Familiarity with HIPAA group health plan compliance is a plus but not required

Benefits

• Flexible work environment
• Vacation Bonus
• Flexible paid time off
• Paid parental leave
• Competitive pay
• A full suite of traditional benefits
• Training/Advancement opportunities
• 401k with company match and immediate vesting
• Financial wellness education
• Company-contributed HSA
• On-site perks include gym, pickleball, snacks & drinks, arcade, theater room, etc.

Our Core Values

• Disruptive Visionaries: Our customers are the heroes, and our role is to be a guide on their journey, truly listening and identifying the needs and wants of our customers.
• Relationship Builders: We treat people as people, building strong relationships through empathy, compassion, and honest communication.
• Candor Seekers: Candid conversations are critical to achieving objectives, and we nurture a culture of caring personally and challenging directly.
• Action Owners: Every employee takes ownership of any failures and develops a plan to win, no matter their tenure or circumstance.

More about Vasion

Visit https://www.vasion.comto learn more about Vasion.

Additional Information

Vasion is an equal opportunity employer. We evaluate qualified applicants without regard to race, age, color, religion, sex, national origin, disability, veteran status, gender identity, sexual orientation and other legally protected characteristics.