Senior Privacy & Information Security Specialist

Quo; United States; Remote; USD 168,000 - 220,000; Full time

Job summary

Quo is seeking a Senior Privacy & Information Security Specialist to own and scale our privacy and data governance program. You will turn regulatory requirements (CCPA/CPRA, PIPEDA) into working controls, coordinating Support, Marketing, Legal, and Engineering to meet them.

You will manage the end-to-end DSR workflow, build dashboards, define escalation paths, and maintain an audit-ready record of decisions.

Qualifications

• Experience in privacy operations, privacy engineering, data governance, or GRC, including running DSR workflows across multiple systems and teams.
• Knowledge of CCPA/CPRA and PIPEDA, and modern application architecture: APIs, databases, identity systems, SaaS, and cloud environments.
• Ability to translate legal or regulatory requirements into technical controls and repeatable procedures.
• Strong written communication and sound judgment with sensitive, time-sensitive requests.
• Ability to drive cross-team work without direct authority across Legal, Support, Marketing, Product, and Engineering.

Responsibilities

• Own end-to-end DSR lifecycle from intake to closure for access, deletion, and portability.
• Build SLOs, dashboards, and reporting on DSR metrics.
• Define escalation paths and audit-ready decision records.
• Create training and playbooks for handling requests.
• Maintain data inventory and data-flow maps across systems.
• Review new products and vendors for privacy risk and DPAs.
• Identify opportunities to automate DSR steps.
• Support privacy and security policies and controls.
• Assist in risk assessments and audits preparation.
• Support privacy incident response with Legal and Security.

Skills

Privacy operations

Privacy engineering

Data governance

GRC

APIs

Cloud environments

Communication

Cross-team collaboration

Education

CIPP/US

CIPP/C

CIPT

CIPM

CISSP

CISA

CRISC

Tools

SOC 2

ISO 27001/27701

NIST CSF

Job description

Small businesses represent 99.9% of all companies, yet they're still forced to choose between clunky, outdated enterprise phone systems or their personal phones. This multi-billion dollar market has been overlooked for decades, left to cobble together solutions that slow them down instead of helping them grow.

Quo is changing that. We bring calls, texts, and customer information together into one easy-to-use, AI-powered platform. We're not just building a phone system. We're setting a new standard for how businesses connect with their customers.

Driven by our values, we move fast, build with determination, and obsess over delivering value to the businesses that have been underserved for far too long.

Today, Quo is trusted by more than 120,000 companies and rated #1 in customer satisfaction on G2. We're backed by Y Combinator, Tiger Global, Craft Ventures, Slow Ventures, and other top-tier investors. It's safe to say we're onto something big.

About the role

We're looking for a Senior Privacy & Information Security Specialist to own the operation of Quo's privacy and data governance program, with a sharp focus on a fast, defensible data subject request (DSR) process. This is a senior individual-contributor role that turns requirements under CCPA/CPRA and PIPEDA into working controls, and coordinates Support, Marketing, Legal, and Engineering to meet them.

DSR operations:

• Own the end-to-end request lifecycle: intake, identity verification, fulfillment across systems, and closure, covering access, deletion, correction, portability, and opt-outs
• Build SLOs, dashboards, and reporting on request volume, turnaround, exceptions, and deadline compliance
• Define escalation paths and exception handling for complex or high-risk requests, and keep an audit-ready record of every decision
• Build training, documentation, and playbooks for the teams who handle requests
• Maintain a data inventory and data-flow maps across production, analytics, marketing, support, and third-party systems
• Build and maintain controls for data minimization, retention, secure deletion, consent, and preference management, including how they apply to AI/ML training data, inference logs, and model outputs
• Review new products, vendors, and integrations for privacy risk, including DPA and subprocessor upkeep
• Identify opportunities to automate manual DSR and privacy steps, with review and approval preserved
• Support the development of privacy and security policies, standards, and controls
• Participate in risk assessments, control-gap analysis, and remediation planning, and coordinate evidence collection for audits
• Support privacy incident response, including breach scoping and regulatory notification timelines (CCPA/CPRA, GDPR, PIPEDA), alongside Legal and Security
• Track changes in privacy regulation and help assess their operational impact with Legal

About you

• Significant experience in privacy operations, privacy engineering, data governance, or GRC, including running DSR workflows across multiple systems and teams
• Working knowledge of CCPA/CPRA and PIPEDA, and of modern application architecture: APIs, databases, identity systems, SaaS, and cloud environments
• Comfortable mapping data flows and translating legal or regulatory requirements into technical controls and repeatable procedures
• Strong written communication and sound judgment with sensitive, ambiguous, or time-sensitive requests
• Able to drive cross-team work without direct authority, across Legal, Support, Marketing, Product, and Engineering

Nice to have:

• Experience with privacy, consent-management, data-discovery, or GRC platforms
• Familiarity with SOC 2, ISO 27001/27701, or the NIST CSF / Privacy Framework
• CIPP/US, CIPP/C, CIPT, CIPM, CISSP, CISA, CRISC, or similar certifications

Compensation

The annual base salary range for this position is as follow, plus equity and benefits:

• SF Bay Area, Los Angeles, Seattle, Portland, Boston, New York, and Washington, DC Metro: $187,000 - $220,000 USD
• All other US Locations: $168,000 - $198,000 USD
• Canada: $172,000 - $202,000 CAD

The ranges displayed reflect the target for new hire salaries, and within each range, individual pay is determined by your skills and experience, as well as relevant education. Your recruiter can share more and answer questions about the specific salary range during the hiring process.

Salary is just one component of Quo’s total compensation package. Your total rewards package will include equity, extensive medical coverage, a monthly lifestyle stipend, and a flexible PTO policy.

Who we are

We're a remote-first company with a culture of trust, autonomy, and action. As we rapidly grow, we're intentionally building communities in a handful of hub cities while continuing to hire great talent wherever they happen to live. If you're looking for a place to do your best work, we'd love to hear from you.

And remember, there's no such thing as a 'perfect' candidate. We're looking for optimists with grit and determination, who are excited to face the challenges of a growing startup. Quo is the type of company where you can grow, and we encourage you to apply for this role even if you don't think you meet all the requirements.

We are committed to creating an inclusive and diverse work environment. It is important that you are able to bring your authentic self to work every day. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. #LI-Remote #PostLI