Privacy Manager

About the Role:

We are seeking a talented and motivated Privacy Manager who is best in class, with a high IQ plus a high EQ. This role presents an exciting opportunity to thrive in a dynamic, fast-paced environment within a rapidly growing team, with abundant prospects for career advancement.

Sezzle is building a formal, company-wide privacy program on the NIST Privacy Framework, and we are hiring the person who will build it and run it. This is a ground-floor build with the hard parts already cleared: executive sponsorship is in place, the implementation roadmap is defined, and the core program materials are drafted. Your job is to turn that foundation into an operating program, and then to own the program as it matures.

As our Privacy Manager, you will drive the implementation end to end: the enterprise data map, the privacy risk assessments, the privacy review process, the de-identification standard, and the governance rhythm that keeps it all running. This role sits at the intersection of privacy and product. The goal is not to slow the business down; it is to give every data initiative a fast, well-documented path to yes, including the data-driven products and analytics that are central to Sezzle’s strategy. You will ensure our data practices protect our users across the US and Canada while enabling our product and engineering teams to build at speed.

What You’ll Do:

• Build the program: Drive Sezzle’s implementation of the NIST Privacy Framework from roadmap to operating program, including Current and Target Profiles, gap analysis, a prioritized and costed action plan, and ongoing monitoring, aligned with US state and federal requirements (CCPA/CPRA and other state comprehensive privacy laws, GLBA, TCPA) and Canadian privacy laws (PIPEDA and Quebec’s Law 25).
• Run privacy review: Own privacy risk assessments and Privacy Impact Assessments (PIAs) for new products, features, and third-party vendors, and operate an intake and disposition process that gives every proposal a fast, documented answer: approved, approved with controls, or needs redesign.
• Own the data map and consumer rights: Build and maintain the enterprise data inventory and data map in partnership with Engineering, tracking the lifecycle of consumer information, and manage the automation and fulfillment of consumer access, deletion, and opt-out requests.
• Operationalize privacy-enhancing techniques: Administer Sezzle’s de-identification and aggregation standard and its approval workflow so that data-driven products and analytics ship with the right controls designed in from the start.
• Embed privacy-by-design: Partner directly with Engineering, Product, and Marketing teams during early-stage development so that privacy requirements are designed in, not bolted on.
• Govern, measure, and report: Run the cadence of Sezzle’s cross-functional privacy working group, maintain the program’s decision log and obligations register, track program metrics, and support executive and board-level reporting. Collaborate closely with the Information Security team to manage, investigate, and mitigate privacy incidents and cross-border data transfer risks.

What We Look For:

• Proven Builder: 4+ years of dedicated experience managing data privacy programs, including at least one program or major program component (a data inventory, a consumer rights operation, a privacy review process) that you stood up from early stage to steady state rather than inherited. High-growth fintech, e-commerce, or SaaS experience operating in both the US and Canada is ideal.
• Framework Fluency: Hands-on experience implementing a recognized privacy or security framework (NIST Privacy Framework strongly preferred; NIST CSF or ISO 27001 also relevant), including profiles or maturity assessments, gap analyses, and action plans.
• Deep Regulatory Knowledge: Strong working knowledge of major North American privacy frameworks (CCPA/CPRA and the broader US state privacy law landscape, TCPA, GLBA, PIPEDA, Quebec Law 25) and a sharp knack for translating complex legal mandates into clear, actionable business processes.
• Product-Enablement Mindset: You treat privacy as the path to yes. You are fluent in de-identification, aggregation, and other privacy-enhancing techniques as tools that let data products launch responsibly, and you can defend the line between what is de-identified and what is not.
• Cross-Functional Communication: High emotional intelligence (EQ) with the ability to influence technical and non-technical stakeholders alike, run a cross-functional working group, and present clearly to executives.
• Problem-Solving Ownership: A self-starter mindset with the ability to manage multiple high-stakes projects simultaneously in an environment where speed and agility matter.

Preferred Qualifications:

• CIPM (privacy program management) plus CIPP/US or CIPP/C; CIPT is a plus.
• Technical familiarity with modern privacy tech platforms (e.g., OneTrust, Securiti.ai, WireWheel) and data infrastructure analytics.
• Experience navigating financial regulations and compliance frameworks (e.g., GLBA, PCI-DSS) alongside traditional consumer privacy laws.
• Public-company experience, including supporting audit committee or board-level reporting.

About You:

• You have relentlessly high standards - many people may think your standards are unreasonably high. You are continually raising the bar and driving those around you to deliver great results. You make sure that defects do not get sent down the line and that problems are fixed so they stay fixed.
• You’re not bound by convention - your success, and much of the fun, lies in developing new ways to do things.
• You need action - speed matters in business. Many decisions and actions are reversible and do not need extensive study. We value calculated risk-taking.
• You earn trust - you listen attentively, speak candidly, and treat others respectfully.
• You have backbone; disagree, then commit - you can respectfully challenge decisions when you disagree, even when doing so is uncomfortable or exhausting. You have conviction and are tenacious. You do not compromise for the sake of social cohesion. Once a decision is determined, you commit wholly.
• You deliver results - you focus on the key inputs and deliver them with the right quality and in a timely fashion. Despite setbacks, you rise to the occasion and never settle.