Privacy, Security, and AI Compliance Specialist

Privacy, Security, and AI Compliance Specialist

Napster

Location: Remote
- Anywhere in US (CST, EST) or UK

Napster is an AI-first platform company. We build and deploy AI agents across consumer, enterprise, and developer products, and we run hardware in public spaces. As the company continues to grow across global markets and expand its technology and product offerings, we are building scalable operational, security, privacy, AI governance, and compliance programs that support the business today and position us for future growth.

We are looking for a Privacy, Security and AI Compliance Specialist to help run and maintain Napster’s privacy, security, AI governance, and compliance framework across our global organization.

The Privacy, Security and AI Compliance Specialist will be responsible for assisting with implementing, operating, and maintaining Napster’s privacy fundamentals, security, PIMS procedures, incident handling, data mapping, vendor/privacy risk, and AI governance compliance programs across our global operations.

This is a hands‑on role for someone who is comfortable taking day‑to‑day charge of the documentation, and registers behind several compliance programs  will help support and maintain Napster’s Privacy Information Management System (PIMS), Information Security Management System (ISMS), and AI Management System (AIMS), and assist with compliance efforts across ISO 27001, ISO 27701, ISO 42001, SOC 2, and other applicable privacy and security frameworks.

Working under the Operations Department, you’ll work closely with other teams to translate regulatory, contractual, and certification requirements into practical processes that can scale with the company.

• Support the operation and maintenance of Napster's Privacy Information Management System (PIMS) and supporting privacy compliance framework, as defined by the program.
• Maintain the documented scope of Napster's privacy and information security management systems across entities, systems, products, and business operations, and flag changes that require a scope decision.
• Maintain data maps, records of processing activities, retention requirements, and data subject request processes across applicable jurisdictions.
• Document and review controller and processor classifications for new and existing controllers and processors as relevant, and the appropriate privacy controls for Napster’s processing activities.
• Conduct privacy reviews and Data Protection Impact Assessments (DPIAs) for new products, features, vendors, and the record of processing activities (ROPA).
• Operate and refine the processes that align Napster's day‑to‑day operations with applicable privacy, security, regulatory, and contractual requirements.
• Maintain the documented process for the full personal data lifecycle, including collection, use, retention, transfer, return, and secure disposal, end‑to‑end.
• Assist with the data subject request process, including intake, identity verification, response within statutory deadlines, and auditable record‑keeping.
• Maintain PIMS governance documentation, including defined roles and decision rights, documented PIMS objectives, and a tracker showing status against those objectives.
• Compile and report PIMS performance metrics defined by the program as requested.

• Assist with Napster’s compliance certification and attestation programs, including ISO 27001, ISO 27701, ISO 42001, and SOC 2, along with compliance with data protection legislation.
• Assist with readiness and gap assessments.
• Assist with the maintenance of audit‑ready policies, standards, procedures, controls, and supporting documentation.

• Maintain the…