Senior Data Security & Compliance Manager

At Nuna, we believe every family deserves thoughtfully designed products that combine safety, innovation, and style. As a global premium baby gear brand, our core values of Community, Generosity, Teamwork, and Excellence guide everything we do, from creating high-quality products to fostering a collaborative and supportive workplace.

We are committed to continuous growth, meaningful impact, and making a difference for families around the world.

Currently we are looking for a Senior Data Security & Compliance Manager to lead the organization's data privacy, data governance, and regulatory compliance programs across both consumer and employee data fulltime- onsite at our Pennsylvania location.

About The Role

Reporting into the Legal function, this role serves as the operational owner of data privacy processes, controls, and compliance frameworks, partnering closely with HR, IT, Security, Product, Operations, and external counsel. This individual will oversee compliance with applicable federal, state, and international privacy regulations, establish governance standards for data handling, lead privacy risk assessments, manage regulatory requests and incident response activities, and drive continuous improvement of privacy and data management practices. The ideal candidate will bring deep expertise in United States privacy regulations, including evolving state privacy laws, employee data protection requirements, and consumer data governance frameworks.

What You’ll Be Doing

Privacy & Regulatory Compliance

• Manage U.S. enterprise-wide privacy and data governance programs.
• Monitor and interpret privacy, data security, and consumer protection laws across all 50 U.S. states.
• Advise business leaders on compliance requirements related to consumer, applicant, employee, contractor, and candidate data.
• Ensure compliance with applicable regulations including:
  • CCPA/CPRA
  • Virginia Consumer Data Protection Act
  • Colorado Privacy Act
  • Connecticut Data Privacy Act
  • Utah Consumer Privacy Act
  • Emerging state-specific privacy regulations
  • State biometric privacy laws
  • State employee monitoring and employee privacy regulations
  • Federal privacy and cybersecurity requirements
• Partner with Legal, HR, & IT on developing privacy positions, policies, and risk mitigation strategies.

Data Governance & Employee Data Management

• Establish and maintain standards for collection, storage, transfer, retention, and deletion of employee and consumer data.
• Develop data classification, retention, and destruction procedures.
• Partner with HR regarding employee privacy compliance.
• Conduct periodic audits of systems, vendors, and business processes.
• Maintain records of processing activities and data inventories.

Security & Incident Management

• Coordinate privacy-related aspects of cybersecurity incidents and data breach investigations.
• Support breach notification obligations and regulatory reporting.
• Partner with IT Security to ensure appropriate controls are implemented and documented.
• Participate in incident response planning and tabletop exercises.

Vendor & Third-Party Risk

• Review vendor privacy and security controls.
• Support negotiation and administration of:
  • Data Processing Agreements (DPAs)
  • Privacy addenda
  • Data transfer agreements
• Conduct vendor privacy assessments and risk reviews.

Training & Awareness

• Develop U.S. enterprise privacy training programs.
• Deliver targeted training for:
  • HR
  • IT
  • Customer Support
  • Operations
  • Leadership teams
• Promote a culture of privacy-by-design and data stewardship.

Compliance Monitoring & Reporting

• Establish privacy metrics, dashboards, and compliance reporting.
• Conduct periodic compliance reviews and risk assessments.
• Report findings and recommendations to Legal, HR, IT, and Executive Leadership.

This position description is intended to provide a summary of the essential duties, tasks, and responsibilities of this position and shall not be considered an exhaustive listing of all work requirements.

Qualifications

What You Bring

• Bachelor's Degree in:
  • Law
  • Information Security
  • Cybersecurity
  • Information Systems
  • Risk Management
  • Business Administration
  • Related field
• 10 - 15 years of experience in privacy, data governance, compliance, or data protection.
• Experience supporting both employee and consumer data privacy programs.
• Experience interpreting and implementing multi-state privacy requirements.
• Experience partnering with Legal, HR, and Information Security teams.

Preferred Qualifications

• Certified Information Privacy Professional (CIPP/US)
• Certified Information Privacy Manager (CIPM)
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Experience within technology, healthcare, fintech, e-commerce, or SaaS environments.

Skills & Competencies

• Privacy & Data Protection Expertise
• Regulatory Interpretation
• Risk Management
• Policy Development
• Vendor Risk Oversight
• Cross-Functional Influence
• Investigation & Audit Management
• Communication & Executive Presence
• Program Management
• Change Management
• Strong executive presence and ability to interact effectively with senior leadership.
• Possess a clear business-focused outlook and the ability to balance legal risk with commercial objectives.
• Ability to remain poised under pressure or opposition and make sound decisions in high-stakes situations.
• Demonstrated sound judgment, integrity, and commitment to high ethical standards.
• Outstanding listening and communication skills; adept at communicating complex legal concepts to both legal and non-legal audiences.
• Self-starter able to prioritize workload and thrive in a fast-paced environment.
• Proven ability to build collaborative relationships across functions, departments, and international teams.
• Commitment to identifying practical and pragmatic business solutions.

Technology

• Proficient in Microsoft Office Suite.
• Ability to quickly and proficiently learn new software and technologies.
• Experience with litigation management, eDiscovery, contract management, and matter-management systems preferred.
• Familiarity with:
  • Contract Management Software | Cobblestone preferred
  • Project Management Software | Wrike preferred
  • Electronic Signature Platforms
  • Patent Analytics and Competitive Intelligence Tools (PatSnap or similar platforms)