Summary:
The Senior Manager, Privacy Program is a strategic leader of user data integrity and technical governance at Topstep. In a dynamic financial environment where sensitive personal and trading data is paramount, this role is critical to maintaining our status as the most trusted platform.
You will be responsible for building, leading, and maturing a world-class privacy and technical governance program from the ground up. Beyond setting the enterprise-wide strategy to satisfy global regulatory obligations (e.g., GDPR, CCPA), you will directly manage a specialized team consisting of a Technical Governance & Operational Readiness Manager and a Privacy Operations Manager.
Under your leadership, your team will seamlessly integrate Privacy by Design principles into our products, execute day-to-day data subject requests (DSARs), and implement automated, continuous audit readiness for IT governance (e.g., SOC 2, ISO 27001). This role is foundational to scaling Topstep responsibly, automating compliance workflows, and defending our hard-earned reputation.
Key Responsibilities
Team Leadership & Operational Oversight
People Management: Direct, mentor, and develop a high-performing team of privacy and technical governance professionals. Set clear OKRs, conduct performance reviews, and foster a culture of continuous operational improvement.
Function Integration: Seamlessly bridge the daily execution of privacy operations (DSARs, vendor reviews) with broader technical IT governance initiatives (automated control monitoring, audit readiness).
SLA & Metric Management: Establish and monitor team KPIs, ensuring strict adherence to statutory timelines for privacy requests and maintaining real-time visibility into technical control health and framework alignment for executive reporting.
Privacy Program Strategy & Governance
Program Strategy: Design, implement, and direct the comprehensive enterprise-wide privacy program, including developing the core governance framework, policies, standards, and procedures.
Data Classification & Mapping: Oversee the operationalization of a clear data classification system (Public, Internal, Confidential, Restricted). Direct the maintenance of Records of Processing Activities (RoPA) and continuous data flow mapping across the organization.
Privacy by Design (PbD): Serve as the strategic privacy advisor for Product Management and Engineering leadership. Ensure your team effectively embeds privacy-first design and development concepts into new products, services, and features before launch.
Training & Awareness: Direct the development and delivery of engaging, role-specific privacy and data security awareness campaigns across the firm.
Privacy Operations & Incident Management
DSAR & Queue Oversight: Oversee the end-to-end DSAR program (executed by your Privacy Operations Manager via tools like DataGrail). Ensure workflows for access, deletion, and correction requests scale efficiently and align with global legal expectations.
Privacy Incident Leadership: Act as the primary escalation point and incident commander for privacy incidents and data breaches. Partner with Security and Legal teams to drive investigation, containment, remediation, and regulatory notification.
Third-Party Risk Management: Oversee the vendor privacy risk assessment lifecycle. Ensure your team thoroughly evaluates Data Processing Agreements (DPAs) and vendor alignment with Topstep’s privacy standards.
Technical Governance & Audit Readiness
IT GRC Roadmap: Oversee the execution of Topstep’s technical governance roadmap, ensuring engineering and product operations align with firm policies and external frameworks (SOC 2, ISO 27001, NIST).
Continuous Assurance Automation: Champion the shift from manual, spreadsheet-heavy control tracking to automated, frictionless solutions. Direct your Technical Governance Manager in utilizing cloud-native GRC platforms (e.g., Vanta, Drata) for real-time evidence collection.
Policy Architecture Oversight:…