The posting
Summary:
The Senior Manager, Privacy Program is a strategic leader of user data integrity and technical governance at Topstep. In a dynamic financial environment where sensitive personal and trading data is paramount, this role is critical to maintaining our status as the most trusted platform.
You will be responsible for building, leading, and maturing a world-class privacy and technical governance program from the ground up. Beyond setting the enterprise-wide strategy to satisfy global regulatory obligations (e.g., GDPR, CCPA), you will directly manage a specialized team consisting of a Technical Governance & Operational Readiness Manager and a Privacy Operations Manager.
Under your leadership, your team will seamlessly integrate Privacy by Design principles into our products, execute day-to-day data subject requests (DSARs), and implement automated, continuous audit readiness for IT governance (e.g., SOC 2, ISO 27001). This role is foundational to scaling Topstep responsibly, automating compliance workflows, and defending our hard-earned reputation.
Key Responsibilities
Team Leadership & Operational Oversight
- People Management: Direct, mentor, and develop a high-performing team of privacy and technical governance professionals. Set clear OKRs, conduct performance reviews, and foster a culture of continuous operational improvement.
- Function Integration: Seamlessly bridge the daily execution of privacy operations (DSARs, vendor reviews) with broader technical IT governance initiatives (automated control monitoring, audit readiness).
- SLA & Metric Management: Establish and monitor team KPIs, ensuring strict adherence to statutory timelines for privacy requests and maintaining real-time visibility into technical control health and framework alignment for executive reporting.
Privacy Program Strategy & Governance
- Program Strategy: Design, implement, and direct the comprehensive enterprise-wide privacy program, including developing the core governance framework, policies, standards, and procedures.
- Data Classification & Mapping: Oversee the operationalization of a clear data classification system (Public, Internal, Confidential, Restricted). Direct the maintenance of Records of Processing Activities (RoPA) and continuous data flow mapping across the organization.
- Privacy by Design (PbD): Serve as the strategic privacy advisor for Product Management and Engineering leadership. Ensure your team effectively embeds privacy-first design and development concepts into new products, services, and features before launch.
- Training & Awareness: Direct the development and delivery of engaging, role-specific privacy and data security awareness campaigns across the firm.
Privacy Operations & Incident Management
- DSAR & Queue Oversight: Oversee the end-to-end DSAR program (executed by your Privacy Operations Manager via tools like DataGrail). Ensure workflows for access, deletion, and correction requests scale efficiently and align with global legal expectations.
- Privacy Incident Leadership: Act as the primary escalation point and incident commander for privacy incidents and data breaches. Partner with Security and Legal teams to drive investigation, containment, remediation, and regulatory notification.
- Third-Party Risk Management: Oversee the vendor privacy risk assessment lifecycle. Ensure your team thoroughly evaluates Data Processing Agreements (DPAs) and vendor alignment with Topstep’s privacy standards.
Technical Governance & Audit Readiness
- IT GRC Roadmap: Oversee the execution of Topstep’s technical governance roadmap, ensuring engineering and product operations align with firm policies and external frameworks (SOC 2, ISO 27001, NIST).
- Continuous Assurance Automation: Champion the shift from manual, spreadsheet-heavy control tracking to automated, frictionless solutions. Direct your Technical Governance Manager in utilizing cloud-native GRC platforms (e.g., Vanta, Drata) for real-time evidence collection.
- Policy Architecture Oversight: Ensure the centralization and operationalization of technical procedures, review attestation, and exception tracking across engineering partners.
Required Qualifications and Key Competencies
- Experience: 8 + years of progressive experience in privacy, data protection, or IT Governance & Risk programs within regulated environments (Fintech, Financial Services, or SaaS).
- Leadership Experience: 3 + years of direct people management experience, with a proven track record of hiring, mentoring, and scaling governance, risk, or privacy teams.
- Regulatory Expertise: Deep working knowledge of major global privacy regulations (e.g., GDPR, CCPA/CPRA) combined with a strong understanding of core security and control frameworks (e.g., SOC 2 Type II, ISO 27001, NIST CSF).
- Tooling Proficiency: Familiarity with modern privacy automation software (e.g., DataGrail, OneTrust, Transcend) as well as cloud-native governance and risk platforms (e.g., Vanta, Drata, LogicGate).
- Technical Aptitude: Engineering literacy necessary to oversee technical governance roadmaps; ability to understand development pipelines, cloud architecture, and access controls to effectively bridge the gap between Legal/Risk partners and Product/Engineering.
- Operational Excellence: Demonstrated experience moving assurance and control functions from reactive, manual processes to proactive, automated, and metrics-driven operations.
- Communication: Exceptional ability to translate complex legal and technical requirements into practical business guidance for non-experts, with strong executive presence to report up to the C-suite.
Company Culture & Perks
- Topstep is an engaging working environment that ranges from fully remote to hybrid. We foster a culture of collaboration by keeping cameras on during meetings and maintaining a robust Slack environment for communication.
- Seven Company-paid Holidays and generous Family Leave. Paid time off is front-loaded.
- Competitive 401(k) matching, health, dental, and vision insurance are offered for full-time employees
- Vacations are encouraged with a bonus for taking 5 consecutive days. Topstep offers a food and groceries budget and contributes towards health and wellness.
New Hire Base Salary Range
- $155,000 - $185,000 annually.
- The compensation offered will take into account the internal compensation structure and may vary depending on the candidate's geographic region, job-related knowledge, skills, and experience, among other factors.
- This position is eligible for a performance-based bonus as provided by the plan terms and governing documents.
Equal Opportunity Employer
Topstep is an Equal Opportunity Employer. We are committed to fostering an inclusive environment where all employees and applicants are valued. All qualified candidates will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, age, disability, or veteran status, in compliance with applicable federal, state, and local laws.
Interested in the role? Apply today with your resume!
The collection, use, and handling of your data provided in response to this job posting is described further in our Privacy Policy. If you are a California resident, please review our California Notice at Collection.
Notice of Use of Artificial Intelligence in Recruitment and Hiring: Notice Pursuant to 775 ILCS 5/2-102(L). Topstep LLC uses artificial intelligence ("AI") in connection with its recruitment and hiring process. Examples include, but are not limited to, AI tools used to improve job descriptions, generate interview questions, draft communications, assist with scheduling, and source candidates, as well as AI features built into third-party platforms such as LinkedIn, Indeed, and Glassdoor. Topstep will not use AI that has the effect of subjecting employees or applicants to discrimination on the basis of any protected class under the Illinois Human Rights Act.
The collection, use, and handling of your data provided in response to this job posting is described further in our Privacy Policy. If you are a California resident, please review our California Notice at Collection.
