Privacy & AI Governance Specialist; Hybrid Model

Privacy & AI Governance Specialist (Hybrid Work Model)

QRR-4649

London, England, United Kingdom

We are currently seeking a Privacy & AI Governance Specialist to join our Information Security, Privacy & Compliance team. As a Privacy & AI Governance Specialist, you will report to our Data Protection Officer and support the continued maturity of Quorum's global privacy, data protection, and AI governance programs while helping the business navigate evolving regulatory requirements across multiple jurisdictions. You will collaborate with cross‑functional stakeholders to embed privacy‑by‑design and responsible AI practices into business processes, products, and services while supporting compliance, innovation, and operational excellence.

You will also contribute to vendor management, customer assurance activities, and the continuous improvement of Quorum's governance framework.

• Support the design, implementation, and continuous improvement of Quorum's global privacy, data protection, and AI governance programs.
• Maintain privacy documentation, including policies, procedures, templates, playbooks, Records of Processing Activities (RoPA), data maps, and DPIA/PIA materials.
• Advise internal stakeholders on privacy, data protection, vendor reviews, data subject rights, cross‑border data transfers, AI use cases, and privacy‑by‑design principles.
• Conduct and support Data Protection Impact Assessments (DPIAs), Privacy Impact Assessments (PIAs), Transfer Impact Assessments (TIAs), AI risk assessments, and privacy reviews for products, vendors, systems, and business initiatives.
• Review customer and vendor agreements, including Data Processing Agreements (DPAs), Standard Contractual Clauses (SCCs), security schedules, and AI/data use provisions.
• Support vendor management activities, customer audits, pre‑sales security questionnaires, compliance reporting, privacy incidents, and breach response activities.
• Maintain privacy and AI governance inventories, including data processing activities, vendors, AI tools, data flows, and associated risk assessments.
• Monitor global privacy, cybersecurity, and AI regulatory developments, translating legal and regulatory requirements into practical policies, standards, and operational processes.
• Deliver privacy, AI governance, and information security training and awareness initiatives across the organization.
• Collaborate closely with enterprise and business unit stakeholders to integrate privacy, data protection, and AI governance principles into products, services, and business operations.
• Identify, investigate, and help remediate compliance gaps and areas of risk to support ongoing regulatory compliance and continuous improvement.
• Proactively research and maintain a working knowledge of emerging privacy, AI governance, cybersecurity, and data protection laws, regulations, and industry best practices.
• And other duties as assigned.

• Bachelor's degree or equivalent experience in Law, Information Governance, Information Security, Compliance, Risk Management, Business, Technology, or a related field.
• 3+ years of experience in privacy, data protection, compliance, information governance, legal operations, security risk, or a related discipline.
• Working knowledge of GDPR, UK GDPR, CCPA/CPRA, and other global privacy regulations.
• Experience conducting or supporting DPIAs/PIAs, maintaining Records of Processing Activities (RoPA), data mapping, vendor privacy reviews, data subject rights, privacy‑by‑design initiatives, and incident response activities.
• Familiarity with vendor management, risk management, customer audits, compliance reporting, and privacy/security contract reviews, including DPAs and SCCs.
• Previous experience with GRC, privacy, or compliance platforms (e.g., One Trust or similar tools) is preferred.
• Strong analytical, research, documentation, communication, and stakeholder management skills.
• Excellent interpersonal, written, and verbal communication skills, including the ability to communicate complex regulatory concepts to technical and non‑technical audiences.
• Ability to manage multiple priorities in a fast‑paced, global environment.
• Critical‑thinking,…