SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Handshake is a career platform powering 25 million job seekers, 1 million+ employers, and 1,600 educational institutions. The company recently launched Handshake AI, a rapidly growing AI data business that partners with frontier AI labs and Fortune 500 companies, now operating at ~$1B run rate.
The Privacy Associate will support the execution of Handshake's global privacy program as part of the Legal team, reporting to the Senior Director & Counsel, Compliance. This is a hands-on role with broad exposure to privacy operations and AI governance.
Key responsibilities include:
- Vendor and subprocessor management: assess data handling practices, review Data Processing Agreements (DPAs), coordinate cross-functional findings, maintain subprocessor records and disclosures, and track diligence requirements.
- Privacy assessments and records: support preparation and review of Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), and Technology Impact Assessments (TIAs); maintain Records of Processing Activities (RoPAs), data inventories, and retention schedules; coordinate retention and deletion workflows.
- Consent and tracking technologies: administer the Ketch privacy rights and consent platform, maintain consent experiences and jurisdiction-specific rules, run consent testing and cookie/tag scans, work with Marketing and Engineering to categorize tracking technologies and resolve compliance issues.
- Individual rights management: oversee automated rights request processes via Ketch, monitor workflows and deadlines, handle exceptions, spot-check fulfillment, track request metrics, and recommend workflow improvements.
- Customer audits and inquiries: prepare responses to customer questionnaires and audits, coordinate evidence collection, support Sales and Customer Success with privacy questions, maintain approved response materials.
- Incident response support: assist with breach triage, notification analysis, and post-incident documentation alongside Security.
- Regulatory monitoring and policy updates: draft and update privacy notices and public privacy policy as products and laws change; track new and amended privacy and AI laws and summarize implications for Handshake.
- Product and AI review: support privacy team review of new features and AI-enabled functionality by logging intake, gathering data flow information, and tracking follow-up items.
- Training and awareness: deliver privacy training and maintain internal guidance, with focus on teams handling student and customer data.
- Program operations: monitor privacy inbox and Slack channels, respond to routine questions, escalate complex matters, track assessments and requests, prepare metrics and status updates, recommend process improvements.
Requirements:
- At least 2 years of experience supporting privacy, compliance, risk management, or related legal operations
- Experience conducting, reviewing, or supporting privacy assessments, vendor reviews, individual rights requests, or compliance audits
- Working knowledge of GDPR, CCPA/CPRA, other US state privacy laws, and core privacy principles
- Familiarity with DPAs, DPIAs, RoPAs, LIAs, and TIAs
- Ability to read and summarize technical documentation (data flows, architecture diagrams) with Engineering support
- Strong organizational skills, attention to detail, ability to manage competing requests and meet deadlines
- Comfort with workflow tools (Linear, Notion) and spreadsheets
- Clear written and verbal communication skills
- Sound judgment in identifying issues requiring further assessment or legal review
- Interest in AI and automated decision-making intersections with privacy
Bonus qualifications:
- Experience with privacy in consumer-facing, student, or employment contexts
- Privacy program experience at technology companies or global organizations
- Hands-on experience with privacy/consent management platforms (Ketch, OneTrust, TrustArc)
- AI governance, algorithmic impact assessments, or automated decision-making experience
- Cookie and tracking technology compliance experience
- Incident response or breach notification experience
- Customer questionnaire or vendor diligence experience
- Privacy certifications (CIPP, CIPM, CIPT, AIGP)
