Privacy Assurance & Compliance Specialist

Main Role Overview

The Privacy Assurance & Compliance Specialist will manage and support Everway’s global privacy assurance and compliance program, working closely with the Director of Compliance (who serves as the Data Protection Officer, DPO). This role ensures privacy and data protection requirements are embedded into Everway’s products, systems, and business processes. The specialist will identify, manage, monitor, and evidence privacy risks, controls, and regulatory obligations while collaborating with Legal, Data Governance, Information Security, Product, Engineering, People, and other business teams.

Key Focus Areas

The role is centered on privacy assurance, risk, governance, and compliance. Legal handles contractual privacy matters and legal advice, while business and data owners remain responsible for data and processing activities within their domains.

Main Responsibilities

• Support the Director of Compliance in implementing and delivering the privacy workstream of the compliance roadmap, ensuring Everway meets its legal, regulatory, and reputational responsibilities.
• Lead and coordinate specific workstreams within the Compliance roadmap and business improvement projects, such as data mapping, risk management, controls testing, and policy development.
• Lead and coordinate Data Protection Impact Assessments (DPIAs) on products, systems, and processes, tracking risk treatments and embedding Privacy-by-Design from the outset.
• Manage the framework for Data Subject Access Requests (DSARs) and Data Deletion Requests, ensuring robust processes with system owners to guarantee quality and timeliness.
• Identify privacy risks and controls, translating them into practical business processes to improve organizational compliance and supporting incident management.
• Address privacy-focused vendor security inquiries from customers and collaborate with Legal on related requests.
• Maintain and enhance the Knowledge Base and Trust Centre resources to ensure up-to-date compliance documentation.
• Conduct comprehensive internal Vendor Security Reviews to assess and mitigate third-party privacy risks.
• Develop, implement, and maintain internal privacy policies, external privacy notices, procedures, and ELT/governance reporting, including KPIs.
• Lead privacy assurance activities supporting audit and certification initiatives (e.g., ISO 27701, ISO 27001, ISAE 3000, SOC 2) and manage central evidence within GRC tools.
• Monitor regulatory developments, assist with regulator/auditor interactions, and liaise with external and internal legal counsel on cross-jurisdictional privacy matters.

Essential Criteria

• A degree-level (or equivalent) qualification in a related discipline (e.g., Law, Data Protection, Information Security, Compliance, or Risk).
• 2+ years of experience in a similar role in data privacy compliance or privacy assurance, ideally within a software, SaaS, or international tech environment.
• Sound working knowledge of EU GDPR, including risk and compliance management.
• Ability to work independently and effectively manage and prioritize workstreams in a dynamic environment.
• Practical experience supporting DPIAs, DSAR/data deletion requests, ROPAs, incident response, and vendor privacy reviews.
• Proven experience translating regulatory requirements into clear, practical business processes and controls.
• Strong cross-functional stakeholder management and communication skills.
• Detail-oriented with strong analytical, problem-solving, and organizational skills.

Desirable Criteria

• Experience working within a SaaS, EdTech, or software development environment.
• Knowledge of ISO 27001, ISO 27701, ISAE 3000, ISO 42001, or SOC 2 frameworks.
• Familiarity with GRC platforms (such as Vanta, OneTrust).
• Relevant privacy or audit qualifications (e.g., CIPP/E, CIPM, or ISO internal auditor training).
• Proficiency with Google Workspace (docs, chat, drive).