Privacy & AI Governance Program Manager

About this Opportunity:

As a Privacy & AI Governance Program Manager, you will be expected to spearhead privacy initiatives and coordinate cross-team collaboration, seeing privacy processes are followed through start to finish.  Serving as Orion's operational hub for privacy, you will own the programs, processes, and documentation that keep the organization regulatory-ready and auditable, partnering closely with Legal, Information Security, and business leaders to build and scale privacy operations from the ground up.  As Orion continues to adopt AI across its business, this role will also lead the organization's AI governance program from a privacy perspective — setting privacy expectations for how AI systems use personal information, reviewing AI use cases for privacy risk, and keeping Orion ahead of emerging AI-privacy requirements.  As we continue to evolve and live our Orion values, we are looking for someone to grow with us. This position will also have the opportunity to participate in crisis management by coordinating cross-functional responses and appropriate stakeholder involvement. As we continue to evolve and live our Orion values, we are looking for someone to grow with us.  

It is anticipated that an incumbent in this role will work as a Hybrid employee, with three (3) or more days each week required on-site at one of the listed office locations.

 

Candidates should be located within a commutable distance to an office. Internal candidates currently aligned to an Orion office location may be given preference; however, internal candidates with varying work arrangements may be considered based on experience and business needs. Work location is subject to change based on business needs.

In this role, you’ll get to:

• Serve as the primary privacy liaison and subject matter expert enterprise-wide, partnering with business and functional leaders across the organization to embed privacy considerations into business decisions, product development, and day-to-day operations

• Develop, improves, and promotes the privacy framework, in conjunction with the vision of direct leadership, and directs and coordinates the privacy program, including associated risk to the organization

• Promote a culture of privacy compliance across the organization through Policy, Process, and/or Procedures; provides guidance to resolve privacy issues brought up from business and functional areas representatives

• Oversee and direct privacy planning and procedure development across the organization, including the management of privacy policies in coordinate with Legal, Risk, and Information Security

• Identify potential areas of privacy vulnerability and risk, develop correction action plans for resolution of problematic issues, provide guidance of risk mitigation, and provide reporting to the Data Protection Officer

• Design, develop, and deliver privacy training programs for new hires and existing employees across all business lines, including Potential Privacy Incident awareness training, annual privacy compliance training, and role-specific privacy guidance

• Manage responses to Potential Privacy Issues, Orion’s Legal Department, Information Security Team, and relevant business lines

• Serve as the organization's primary privacy investigator, managing the full lifecycle of Potential Privacy Incidents across all business lines (OAT and OWM) — from initial intake and triage through investigation, root cause analysis, client notification, and remediation tracking

• Implement the Privacy Incident Response Plan, as needed

• Manage the Data Subject Rights Request (DSSR) process, including reviewing, validating, and responding to requests and maintaining a repository of requests and responses

• Report on data privacy matters to leadership and key collaborators, appropriately escalating any privacy risks as required

• Maintain working knowledge of and operationalizes requirements under CCPA/CPRA, Reg S-P (amended), CIPA, and emerging state privacy laws as applicable to Orion's business lines

• Work in coordination with Information Security Team and assist in Vendor Risk Assessments relating to Privacy

• Assist with Data Privacy Impact Assessments for new and existing business lines, products, and services

• Participate in Orion committee meetings to provide privacy-related input when necessary

• Build and maintain Records of Processing Activities (ROPA), documenting how personal information is collected, used, shared, and retained across Orion's business lines

• Identify and implement process improvements across the privacy program — developing structured workflows, playbooks, and response libraries, and leveraging AI tooling where appropriate — to automate routine tasks and sustain consistent, high-quality privacy operations at scale

• Establish, track, and report on privacy program metrics to measure compliance and operational performance across business lines

• Manage cookie and online-tracking compliance, including consent mechanisms, in coordination with Legal and business lines

• Monitor legal and regulatory developments across applicable local, state, and federal privacy laws, and coordinate with Legal, Information Security, and business units to operationalize new requirements

• Help lead and mature the organization's AI governance program and framework — defining responsible-AI principles, policies, and standards in coordination with Legal, Risk, Information Security, and business leaders

• Maintain an inventory of AI and automated decision-making systems that process personal information, and operate a privacy intake, review, and approval workflow for new and existing AI use cases.

• Conduct privacy reviews and impact assessments for AI and machine-learning use cases that involve personal information, evaluating data minimization, purpose limitation, transparency, and automated decision-making and profiling risks

• Operationalize the privacy-related requirements of emerging AI regulation (e.g., automated decision-making and profiling rules under CCPA/CPRA and the Colorado AI Act) as applicable to Orion's business lines, coordinating with Legal to track and implement new requirements

• Partner with Enterprise Risk Management, Legal, Compliance, Information Security, and Technology teams to manage incidents and crisis response activities

• Support enterprise-wide crisis management and operational resiliency initiatives through response planning, stakeholder coordination, and participation in crisis management activities

We’re looking for talent who:

• Prioritizes tasks based on importance to drive the success of the business and mitigate the organization’s risks

• Has knowledge of the investment advisor industry, operations, and regulatory landscape

• Has knowledge of federal and state privacy laws, rules, and regulations applicable to investment advisory and fintech business lines

• Has a history of developing new policies and procedures based on changes to regulations or business operations

• Learns and adapts to new systems and processes with limited direct training

• Multi-tasks while maintaining careful attention to detail

• Works effectively both individually and within a team environment

• Works with a sense of urgency to meet deadlines and address competing priorities

• Has proficient skills with Microsoft Office software including Word, Excel, PowerPoint, and Outlook

• Has effective written, listening, and verbal communication skills

• Has effective problem solving and organizational skills

• Owns and manages relationships with stakeholders directly and work effectively with people at all levels in an organization

• Has a proven track record of operationalizing and scaling cross-functional, organization-wide programs from the ground up

• Analyzes complex problems to identify root causes and trends, and to translate complex requirements into simple, usable documentation and workflows

• Works in a fast-paced, high-growth environment with tight timelines and shifting priorities

• Has experience using AI tools to accelerate day-to-day privacy operations work

• Has familiarity with global data-protection frameworks (e.g., GDPR) as applicable to Orion's operations

• Has knowledge of privacy requirements applicable to AI, including automated decision-making and profiling rules under laws such as CCPA/CPRA and the Colorado AI Act

• Understands core AI and machine-learning concepts and the associated data-privacy risks, such as the use of personal information in training and inference, profiling, and transparency

• Demonstrates experience managing high-priority incidents and coordinating cross-functional crisis response efforts

• Has strong ability to make risk-informed decisions under pressure and effectively communicate with executive leadership during crisis situations

• Has a minimum of a Bachelors Degree; J.D. preferred

• Has a minimum of 5 years of experience

• Owns and manages relationships with stakeholders directly and works effectively with people at all levels in an organization 

#LI-AP1 

#LI-Onsite 

#LI-Hybrid 

Recommended Skills:

AI Governance, Data Privacy, Data Protection, Data Protection Privacy, Incident Response, Information Security, Privacy Compliance, Privacy Laws, Risk Assessments, Risk Management

Salary Range:

$83,076.00 - $127,179.00

The pay listed in this posting indicates the estimated pay at the time of this posting; however, may vary depending on geographic location, job-related knowledge, skills, and experience. In addition, Orion offers a competitive benefits package which includes health, dental, vision, and disability coverage on day one, 401(k) plan with employer match, paid parental leave, pet benefits including pawternity leave and pet insurance, student loan repayment and more.

About Us

At Orion, we achieve our best work when we support one another, staying personally accountable to each other and the clients we serve. We create a welcoming environment where everyone is respected, valued, and heard. Our commitment to create raving fans ensures we consistently exceed client expectations. Thinking differently is in our DNA—we innovate always, push boundaries, and reject the status quo to deliver transformative outcomes. Together, we support one another and see it through to success, driving our collective achievements and those of our clients.