Security & Privacy Lead

DataDrone Inc.; Cheyenne, Northern (WY, KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

DataDrone Inc. is seeking a Security & Privacy Lead to architect and oversee privacy across all pipelines from kickoff to go-live.

You will guard consent flows, retention rules, and PII handling, ensuring no data slips and no token leaks, while making compliance invisible to clients. The role is client-facing, requiring cross-client compliance checks, strong written and verbal communication, and a mindset that security is non-negotiable.

Responsibilities

• Review every schema, event, and token before they hit prod.
• Protect data trust: ensure consent flows, retention rules, and PII handling are airtight.
• Build rituals, guardrails, and playbooks so compliance runs in the background.
• Manage compliance checks across multiple clients at once.
• Shift conversations from urgency to governance and risk reduction.

Job description

We build fast, reliable, client-centric Segment/CDP implementations — delivered in 45 days. Our model is simple: clarity, predictability, and trust under pressure.

We're looking for a Security & Privacy Lead to join our team. This isn't about box-checking compliance. This is about designing trust into every pipeline. You'll be the one ensuring no sensitive data slips, no token leaks, and no client ever has to wonder "are we compliant?" If Segment is the nervous system, you're the immune system.

What You'll Do

• Own compliance from kickoff → go-live: Review every schema, event, and token before they hit prod.
• Protect data trust: Ensure consent flows, retention rules, and PII handling are airtight.
• Make security invisible: Build rituals, guardrails, and playbooks so compliance runs in the background.
• No surprises: Clients should never discover issues before you do.
• Multi-engagement mode: Manage compliance checks across multiple clients at once, without dropping the ball.
• Educate and reframe: Shift conversations from "this slows us down" to "this saves us from regulatory fire drills."

Daily Rhythm (How You Operate)

• Validate consent flows (GDPR/CCPA) in staging before prod cutovers.
• Maintain rolling compliance logs → if it's not logged, it didn't happen.
• Review and rotate tokens, keys, and access controls (least privilege).
• Keep all governance docs live and usable (Notion/Confluence).
• Catch issues before the client does — no surprises.
• Timezone Flexibility: clients pick NA/EMEA/APAC — we mirror it.

Key Responsibilities

• Validate consent flows (GDPR/CCPA) in staging before prod cutovers.
• Enforce PII governance and schema rules in partnership with Data Quality.
• Review and rotate tokens, keys, and access controls (adhering to the principle of least privilege).
• Maintain rolling compliance logs → if it's not logged, it didn't happen.
• Handle client audits, DPAs, and legal/privacy escalations.
• Keep all governance docs live and usable (Notion/Confluence).

What We're Looking For

• Strong experience with data governance, privacy, or security in SaaS/martech.
• Familiarity with Segment (or equivalent CDPs), consent flows, and token handling.
• Comfort with reviewing contracts (DPAs, vendor agreements).
• Strong written and verbal communication skills — can explain GDPR/CCPA to executives without using jargon.

Bonus Points For

• Experience with CMPs (OneTrust, TrustArc) and DLP tools.
• Prior work leading compliance in martech/data projects.
• Creating governance playbooks, checklists, or reusable templates.

The Mindset We Hire For

• You don't wait for problems — you stop them before they exist.
• Fast is fine, but secure is non-negotiable.
• You don't just enforce rules, you design habits and guardrails that make security effortless.
• If someone dares to find fault with your governance, you'll already have the logs ready.

Success in This Role

• 30 days → Running compliance checks, logging activity, and validating tokens without handholding.
• 90 days → Owning reusable security playbooks, mentoring others, and driving trust as a competitive advantage.

Tools You’ll Use

Segment Access Controls and Debugger, CMPs (OneTrust/TrustArc), Destination logs + Warehouse spot-checks (Snowflake/BigQuery/Redshift), Slack, Trello, Notion/Confluence, Contract/DPA management tools, Calendar + Vidyard (client walkthroughs).

Why Join Us

This isn't a back-office compliance gig. This is client-facing, pressure-tested, and foundational to everything we do. You'll shape how companies trust and scale their CDP. If you thrive on clarity, guardrails, and making security invisible, this is your home.

If not, you'll burn out fast. We're not for everyone — and that's the point.

Self-Check Before You Apply

• Can I spot PII in an event payload at a glance?
• Can I explain consent to a VP in under 90 seconds?
• Do I instinctively log my checks so I'm always audit-ready?
• Could I rotate a token or shut off a flow without breaking a sweat?
• Would I bet my bonus this pipeline survives an audit tomorrow?

If three or more are yes, that's you — apply.