Security & Privacy Lead

We build fast, reliable, client-centric Segment/CDP implementations — delivered in 45 days. Our model is simple: clarity, predictability, and trust under pressure.

We're looking for a Security & Privacy Lead to join our team. This isn't about box-checking compliance. This is about designing trust into every pipeline. You'll be the one ensuring no sensitive data slips, no token leaks, and no client ever has to wonder "are we compliant?" If Segment is the nervous system, you're the immune system.

• Own compliance from kickoff → go-live:
  Review every schema, event, and token before they hit prod.
• Protect data trust:
  Ensure consent flows, retention rules, and PII handling are airtight.
• Make security invisible:
  Build rituals, guardrails, and playbooks so compliance runs in the background.
• No surprises:
  Clients should never discover issues before you do.
• Multi-engagement mode:
  Manage compliance checks across multiple clients at once, without dropping the ball.
• Educate and reframe:
  Shift conversations from "this slows us down" to "this saves us from regulatory fire drills."

• Validate consent flows (GDPR/CCPA) in staging before prod cutovers.
• Maintain rolling compliance logs → if it's not logged, it didn't happen.
• Review and rotate tokens, keys, and access controls (least privilege).
• Keep all governance docs live and usable (Notion/Confluence).
• Catch issues before the client does — no surprises.
• Timezone Flexibility: clients pick NA/EMEA/APAC — we mirror it.

• Validate consent flows (GDPR/CCPA) in staging before prod cutovers.
• Enforce PII governance and schema rules in partnership with Data Quality.
• Review and rotate tokens, keys, and access controls (adhering to the principle of least privilege).
• Maintain rolling compliance logs → if it's not logged, it didn't happen.
• Handle client audits, DPAs, and legal/privacy escalations.
• Keep all governance docs live and usable (Notion/Confluence).

• Strong experience with data governance, privacy, or security in SaaS/martech.
• Familiarity with Segment (or equivalent CDPs), consent flows, and token handling.
• Comfort with reviewing contracts (DPAs, vendor agreements).
• Strong written and verbal communication skills — can explain GDPR/CCPA to executives without using jargon.

• Experience with CMPs (One Trust, Trust Arc) and DLP tools.
• Prior work leading compliance in martech/data projects.
• Creating governance playbooks, checklists, or reusable templates.

• You don't wait for problems — you stop them before they exist.
• Fast is fine, but secure is non-negotiable.
• You don't just enforce rules, you design habits and guardrails that make security effortless.
• If someone dares to find fault with your governance, you'll already have the logs ready.

• 30 days → Running compliance checks, logging activity, and validating tokens without hand holding.
• 90 days → Owning reusable security playbooks, mentoring others, and driving trust as a competitive advantage.

Segment Access Controls and Debugger, CMPs (One Trust/Trust Arc), Destination logs + Warehouse spot-checks (Snowflake/Big Query/Redshift), Slack, Trello, Notion/Confluence, Contract/DPA management tools, Calendar + Vidyard (client walkthroughs).

This isn't a back-office compliance gig. This is client-facing, pressure-tested, and foundational to everything we do. You'll shape how companies trust and scale their CDP. If you thrive on clarity, guardrails, and making security invisible, this is your home.

If not, you'll burn out fast. We're not for everyone — and that's the point.

• Can I spot PII in an event payload at a glance?
• Can I explain consent to a VP in under 90 seconds?
• Do I instinctively log my checks so I'm always audit-ready?
• Could I rotate a token or shut off a flow without breaking a sweat?
• Would I bet my bonus this pipeline survives an audit tomorrow?

If three or more are yes, that's you — apply.