Privacy Program Manager

In this role, you can expect to

• Own PlayOn's privacy program governance: CCPA, COPPA, and applicable state privacy laws as they apply.
• Drive compliance remediation work in partnership with Legal and external privacy counsel.
• Conduct Privacy Impact Assessments (PIAs) for new products, features, and vendor relationships, surfacing real risk and driving resolution, not just documenting it.
• Maintain Records of Processing Activities (ROPA) and the company-wide data inventory; validate accuracy across all three product platforms.
• Oversee privacy processes and ensure activities align with program requirements and are conducted within SLA.
• Participate in the Data Privacy Council (DPC) as the privacy program's subject matter expert.
• Maintain and update external-facing privacy policies, internal notices, and employee data handling guidelines.
• Conduct vendor privacy risk assessments during onboarding and annual vendor reviews.
• Support GRC program, including evidence collection for Compliance reports and audits, e.g. SOC 2 Type II.
• Own the security questionnaire response process for customer and prospect privacy inquiries.
• Track and report privacy program metrics, open risks, and remediation progress to the CISO.

To thrive in this role, you have

• 3–5 years of privacy program experience at a consumer-facing technology company — operational track record, not just policy or legal advisory.
• CCPA compliance experience.
• Working knowledge of COPPA and the practical implications for products serving minors or educational institutions.
• Experience conducting PIAs and privacy risk assessments that produce actionable decisions, not just documentation.
• Familiarity with data mapping and ROPA methodology — you have built or maintained a data inventory before.
• Comfortable working in a governance and oversight model — advising and holding partner teams accountable rather than owning every operational process directly.
• Strong written communication: clear privacy notices, precise questionnaire responses, no marketing language.
• Ability to work across Legal, Data Governance, and Engineering, each with different incentives and vocabulary.
• CIPP/US certification or actively pursuing one.
• GRC platform familiarity (Vanta, Hyperproof, Drata, or equivalent) — evidence workflows and control mappings.
• Experience with additional U.S. state privacy laws (VCDPA, CPA, CTDPA, and others as they apply).
• COPPA operational experience for student or minor-facing consumer products is strongly preferred.
• PCI DSS familiarity is a plus — GoFan processes payment data across ticketing products.

How You Play

Ownership over Participation- You take responsibility for achieving holistic outcomes, prioritize key objectives, and adapt quickly when situations require a different approach. You follow through even against the toughest challenges.
Team over Stars- You are a bridge builder, establishing processes and relationships with teams outside your own. You work to rally around common goals, find win-win solutions, compromise when necessary, and help others succeed.
Growth over Comfort- You are driven by a desire to grow and actively seek opportunities to expand your comfort zone, skills, and confidence. You embrace new challenges with curiosity, accepting discomfort and failure as opportunities to learn. 
Fairness over Popularity- You approach decisions with a scientist's mindset, challenging your assumptions and remaining objective. You consider long-term impact rather than relying on short-term gains, proactively seek others' perspectives, and manage emotions in decision-making.