Senior Privacy & Data Governance Lead — Remote

BILL; United States; Remote; USD 111,000 - 164,000; Full time

Benefits offered by this job

Health, dental, vision plans

HSA/FSA accounts

12+ holidays and wellness days

401(k) retirement plan

Employee stock purchase program

Job summary

BILL seeks a Sr. Privacy Program Manager to scale privacy operations across Legal and Compliance. You will own DSARs, PIAs, DPIAs, vendor privacy reviews, and privacy impact assessments for new products and AI features.

Collaborate with Product, Engineering, InfoSec, CX and Procurement to implement automation and AI tooling, monitor regulatory changes (CCPA/CPRA, GDPR) and train teams. Remote-first with US offices.

Qualifications

• 7+ years in privacy, compliance or technology program management, incl. 4–5 years in privacy operations.
• Working knowledge of major privacy laws (CCPA/CPRA, GDPR, HIPAA, GLBA).
• Experience with AI tools in daily work and privacy risk assessment.

Responsibilities

• Own and scale privacy and data governance programs across the company.
• Serve as primary contact for privacy escalations and DSARs from across the business.
• Manage DSAR program end-to-end: intake, tracking, fulfillment, metrics.
• Lead privacy impact assessments for new products, features, and vendors.
• Oversee privacy reviews for AI features and internal AI tool adoption.
• Develop data maps and records of processing; stay current on systems handling data.

Skills

Privacy program management

DSARs handling

PIAs/DPIAs

TIAs

Vendor privacy reviews

AI tools usage

CCPA/CPRA knowledge

Privacy training

Education

Bachelor’s degree

CIPP/US

CIPP/E

CIPM

CIPT

Tools

OneTrust

Transcend

TrustArc

Job description

BILL seeks a Sr. Privacy Program Manager to scale privacy operations across Legal and Compliance. You will own DSARs, PIAs, DPIAs, vendor privacy reviews, and privacy impact assessments for new products and AI features.

Collaborate with Product, Engineering, InfoSec, CX and Procurement to implement automation and AI tooling, monitor regulatory changes (CCPA/CPRA, GDPR) and train teams. Remote-first with US offices.