layiq

/la·yiq/adjective

worthy; deserving; fitting; suitable.

A role, opportunity, or path that merits attention, time, and pursuit.

LAYIQ - Data Privacy, Cybersecurity & AI Compliance Manager at Hippo

Privacy Program Build & Ownership: Design, build, and run Hippo's enterprise data privacy compliance program, maturing it from today's operational footing into a documented, auditable program: governance and accountability structure, data inventory and records of processing, privacy impact assessment process, policy framework, program metrics, and a regulatory change management process covering CCPA/CPRA, other state privacy laws, and insurance-specific privacy requirements (e.g., GLBA and state insurance privacy laws)
Privacy Operations & Consumer Rights: Own Hippo's privacy mailbox and consumer rights request process end to end:
intake, verification, tracking, and timely response to access, deletion, correction, and opt-out requests, with documentation sufficient to withstand regulatory scrutiny
Marketing & Advertising Compliance: Own compliance for marketing and outreach channels, including TCPA/telemarketing and SMS consent requirements (CTIA messaging standards, consent capture and logging, opt-out handling), CAN-SPAM, and website tracking technologies (cookies, pixels, session replay) and consent management; partner with Marketing and Growth teams on campaign and disclosure review
Cybersecurity Regulatory Compliance: Support compliance with insurance-specific cybersecurity regulations (NYDFS 23 NYCRR 500, NAIC Insurance Data Security Model Law and state adoptions) and general frameworks (e.g., NIST); support annual certifications, risk assessments, and regulatory exams and audits, and maintain required documentation
Cyber Event Handling: Partner with Information Security on the triage, investigation, containment, and resolution of cyber events; own the compliance workstream for each event, including documentation, materiality and notification analysis support (state breach statutes, NYDFS 72-hour reporting), and remediation tracking, escalating legal determinations to counsel
AI Governance & Compliance: Build and maintain Hippo's AI compliance framework, including use case intake, risk assessment, inventory, and monitoring for AI/ML systems across the business; track state, federal, and international AI regulation relevant to insurance (algorithmic accountability, AI in underwriting, claims, and pricing, model governance requirements)
Vendor & Third-Party Risk: Conduct privacy and data-protection reviews of vendors and third-party service providers, support the data processing agreement process with Legal, and partner with InfoSec on third-party security diligence, including NYDFS Section 500.11 TPSP requirements
Policies, Standards & Training: Draft, maintain, and operationalize internal policies, standards, and procedures for data privacy, cybersecurity, and AI use, and develop and deliver company-wide training and awareness on those policies, in coordination with the Sr. Enterprise Compliance Director and Legal
Regulatory Liaison Support: Serve as a day-to-day point of contact for regulatory inquiries, exams, and audits touching privacy, cyber, and AI, coordinating responses and escalating legal interpretation questions to attorney oversight
Cross-Functional Partnership: Work closely with Legal, Information Security, Engineering, Marketing, and business units to embed privacy, security, and AI compliance requirements into products, processes, and vendor relationships
Must Haves: 5+ years of experience in data privacy, cybersecurity, and/or AI governance compliance within a regulated industry, including hands-on operational experience (consumer rights requests, incident response, marketing compliance), not just policy work
Bachelor's degree; one or more relevant certifications strongly preferred: CIPP/US, CIPM, or CIPT (IAPP privacy certifications), AIGP (IAPP Artificial Intelligence Governance Professional), CISSP, CISM, CRISC, or CDPSE
Demonstrated experience building or significantly maturing a privacy or compliance program, not solely running an established one
Working knowledge of key privacy, marketing, and cybersecurity regulatory frameworks (CCPA/CPRA and other state privacy laws, TCPA, GLBA, NYDFS 23 NYCRR 500, NAIC Insurance Data Security Model Law)
Familiarity with the emerging AI regulatory landscape and how it applies to insurance use cases (underwriting, claims, pricing, customer service)
Experience supporting security incident response and breach notification analysis in partnership with information security and legal teams
Strong written communication skills, including experience preparing reporting for senior management, board, or committee audiences
Experienced working in close partnership with legal counsel and knows when to escalate for legal interpretation
Strong program and project management skills; able to manage multiple regulatory workstreams simultaneously
Technical aptitude and the ability to quickly learn new technologies and platforms (privacy management, consent management, and GRC tooling a plus)
Nice to Haves: Insurance industry experience strongly preferred (P&C a plus)

Data Privacy, Cybersecurity & AI Compliance Manager

Employer job description

Reporting to:

About Hippo:

About You:

What You'll Do:

Benefits and Perks:

Equal opportunity and accommodations

About this listing

Listing check

Similar jobs

Similar jobs