Senior Manager, Data Privacy & Security Compliance

TruLegal (formerly TRU Staffing); United States; Remote; USD 175,000 - 200,000; Full time

Job summary

TruLegal (formerly TRU Staffing) seeks a Senior Manager of Data Privacy & Security Compliance to own and build the privacy program. This remote role focuses on AdTech/MarTech and data brokerage, driving strategy, tooling, and day-to-day execution with audit readiness across federal and state laws.

The position partners with engineering, legal, and security to ensure robust privacy controls, DPIAs, ROA, and Do Not Call compliance, while supporting rapid program maturation.

Qualifications

• Experience overseeing privacy, data governance, or regulatory compliance operations.
• Advanced knowledge of U.S. privacy regulations (CCPA/CPRA, SBs).
• Strong TCPA and telemarketing compliance understanding.
• Familiarity with privacy and security frameworks (ISO 27001/27701, NIST, SOC 2).
• Ability to work with engineering on privacy controls and data handling.

Responsibilities

• Lead day-to-day privacy and regulatory compliance activities across the business.
• Manage consumer privacy rights processes with deadlines and audits.
• Oversee RoPA, data inventories, and lifecycle data flows.
• Improve automated privacy workflows and consent management.
• Maintain website tracking disclosures and consent mechanisms.
• Coordinate PIAs/DPIAs for new data offerings.
• Represent data privacy in third-party diligence and vendor reviews.
• Support incident response planning and regulatory notifications.
• Track evolving federal/state telemarketing and privacy requirements.

Skills

Privacy compliance

Data governance

Regulatory compliance

AdTech/MarTech experience

ISO/NIST/SOC2 familiarity

Collaboration with engineering

Education

Bachelor's degree in Business/Tech

Tools

Privacy frameworks

Job description

Our client, a rapidly growing, PE-backed performance marketing firm, is seeking a Senior Manager of Data Privacy & Security Compliance to take full ownership of its privacy and compliance program. This is a highly visible, hands-on opportunity with the ability to build and shape the program from the ground up rather than maintain an established function. The ideal candidate will bring strong AdTech/MarTech or lead-generation experience, deep knowledge of TCPA, DNC, and evolving data privacy regulations, and the ability to drive everything from compliance strategy and tooling decisions to day-to-day execution and audit readiness. The company offers a collaborative, down-to-earth leadership team, excellent work-life balance, and the opportunity to make a meaningful impact on a growing business. This is a fully remote opportunity, with a preference for candidates in the Eastern or Central time zones.

Key Responsibilities

• Lead day-to-day privacy and regulatory compliance activities, ensuring business practices align with applicable federal and state requirements governing consumer information, data brokerage, and marketing communications.
• Manage consumer privacy rights processes, including high-volume access, deletion, and opt-out requests, ensuring compliance with applicable statutory deadlines, including 45-day response requirements.
• Oversee data governance practices, including maintaining Records of Processing Activities (RoPA), updating data inventories, and documenting the movement and use of personally identifiable information throughout its lifecycle.
• Work closely with engineering and development teams to improve automated privacy workflows, including consumer preference management and the communication of opt-out instructions to downstream data recipients.
• Maintain oversight of website tracking technologies, including cookies, pixels, SDKs, and related tools, ensuring accurate documentation of their functionality, data collection practices, and associated disclosures.
• Evaluate existing consent management processes to confirm that website tracking activities, consent mechanisms, and privacy notices remain consistent with applicable requirements and published policies.
• Administer TCPA compliance procedures, including internal and national Do Not Call screening, Reassigned Numbers Database checks, consent documentation and retention, and timely processing of consumer revocations.
• Monitor evolving federal and state telemarketing requirements, including state-specific consent obligations, calling restrictions, and Do Not Call regulations.
• Conduct due diligence on third-party data sources, vendor relationships, APIs, and SDKs to assess data provenance, consumer consent, and compliance with applicable privacy obligations.
• Coordinate Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) when evaluating new data offerings or alternative data sources.
• Maintain required data broker and corporate registrations with relevant state authorities, including California, Texas, Vermont, Oregon, and other applicable jurisdictions.
• Administer operational compliance with California's Data Removal and Opt-Out Platform (DROP), including required 45-day data retrieval and update cycles.
• Coordinate independent compliance reviews, security audits, and technical risk assessments, including preparation for the initial state-required assessment scheduled for early 2028.
• Collaborate with information security and engineering teams to maintain appropriate safeguards and support alignment with applicable state data broker security requirements.
• Support incident response planning and execution, including breach containment, documentation, and coordination of applicable state regulatory notifications.
• Identify regulatory developments and potential compliance gaps, recommending practical improvements to privacy processes, technical controls, and operational procedures.

Required Qualifications

• Demonstrated experience overseeing privacy, data governance, or regulatory compliance operations.
• Professional experience within AdTech, MarTech, data brokerage, or lead-generation environments.
• Advanced knowledge of U.S. privacy regulations, including CCPA/CPRA, California's Delete Act (SB 362), the Defending Californians Data Act (SB 361), state data broker registration requirements, and comprehensive state privacy legislation.
• Strong understanding of TCPA requirements, related FCC enforcement priorities, and state-specific telemarketing and consent regulations.
• Familiarity with privacy-related litigation risks involving the California Invasion of Privacy Act (CIPA), Electronic Communications Privacy Act (ECPA), Video Privacy Protection Act (VPPA), Washington's My Health My Data Act, and California's Unfair Competition Law.
• Working knowledge of information security and privacy frameworks, including ISO 27001, ISO 27701, NIST, and SOC 2, with the ability to relate technical controls to compliance obligations.
• Understanding of digital advertising and tracking technologies, including cookies, device fingerprinting, and mobile advertising identifiers (MAIDs).
• Ability to collaborate effectively with technical stakeholders and engineering leadership on privacy controls, data handling practices, and compliance-related initiatives.
• Bachelor's degree in Business Management, Accounting, Technology Management, or a related discipline.

Preferred Qualifications

• Current CIPP/US, CIPM, CIPT, or CISSP certification.
• Juris Doctor (JD) or educational background emphasizing legal studies.
• Demonstrated experience establishing or building privacy or information security programs, rather than solely maintaining established programs.

Expected salary for this exempt role is $175,000 - $200,000, commensurate with experience, training, skills, qualifications, and other market factors.

Job ID: 7652