Privacy Operations Lead

Deepgram is looking for a Privacy Operations Lead to own the operational backbone of our privacy program. Deepgram processes audio across several deployment models: hosted with model-improvement opted in, hosted with model-improvement opted out (effectively zero data retention), single-tenant Deepgram Dedicated deployments with regional data residency, and fully self-hosted deployments running in the customer's own environment. The hosted services run primarily on Deepgram's own bare-metal infrastructure in colocation datacenters, with AWS used for overflow capacity and a small set of services. The role is a senior individual-contributor role that reports to the Director of Information Security and works closely with Legal, Engineering, and Solutions/Sales Engineering. Roughly half the work is assessment and advisory; the other half is designing and operating the processes and tooling that make privacy claims repeatable and verifiable. This is not a policy-writing job.

Responsibilities

Own customer and prospect privacy risk assessments, DPIAs, and transfer impact assessments end to end; Build and maintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments, and own the process that keeps them accurate; Translate GDPR, UK GDPR, CCPA/CPRA, other US state privacy laws, and emerging AI regulation into concrete requirements engineering and GTM teams can act on; Define privacy requirements for product and infrastructure changes and drive them to implementation with owning teams; Own the operating model for privacy controls, including retention and deletion enforcement, DSAR and deletion workflows, consent and opt-out handling, and de-identification and redaction; Design and run operational auditing and remediation workflows; Own the subprocessor and vendor privacy review process, including colocation and infrastructure providers, and the artifacts supporting DPAs and the trust center; Own privacy enablement through playbooks, self-service guidance, and training for Engineering, Support, and Sales Engineering; Partner with Legal on DPAs, SCCs, transfer mechanisms, and residency commitments for dedicated deployments; Partner with Security so privacy and security evidence (SOC 2, ISO 27001, PCI DSS) are produced once and reused

Requirements

Substantial experience in privacy operations, legal operations, or technical privacy and compliance, including running assessments end to end and owning the outcome; Demonstrated ownership of privacy operational systems at scale such as data maps, DSAR workflows, consent management, retention processes, or the tooling behind them; Technically fluent: able to read an architecture diagram, follow a data flow through datacenter and cloud infrastructure, and understand what a log line or retention setting implies; Practical, applied experience with GDPR and CCPA/CPRA, and a current view of where AI regulation is heading; Able to hold your own with a Fortune 500 privacy team or DPO; Clear writer who produces documents that customers, auditors, and engineers rely on; Strong bias toward automating and documenting your own work; Comfortable with ambiguity and making a defensible call when the law is unsettled

Nice to have

CIPM, CIPT, CIPP/E, or equivalent certification; Comfort reading code (Python, Go, Rust, or TypeScript), writing SQL, or scripting your own tooling; Familiarity with on-premise or colocation infrastructure, containerized (Docker) workloads, and data residency outside a single cloud provider; AWS familiarity a plus; Experience with ML/AI data pipelines and training-data governance; Privacy work in a hybrid model combining multi-tenant SaaS with self-hosted or on-premise deployments; Exposure to formal audits: SOC 2, ISO 27001, HIPAA, PCI DSS