Privacy & Data Governance Director

Company Overview

One Park Financial (OPF) is a leading Financial Technology company dedicated to empowering small businesses by connecting them with flexible financing and funding options. Our mission is to provide entrepreneurs with the working capital they need to elevate their businesses. At OPF, we believe in working with high-performing individuals who are ready to play an integral part in our company's expansion — because our success hinges on our people.

Why Join Us?

At OPF, we foster a dynamic and inclusive company culture that emphasizes collaboration, innovation, and personal growth. Our team is composed of passionate, driven individuals who are committed to making a difference. Here’s what you can expect when you join our team:

• Innovative Environment: Work with cutting-edge technology and be part of a team that is constantly pushing the boundaries of fintech.
• Professional Growth: We invest in our employees’ growth with continuous learning opportunities, training programs, and career advancement paths.
• Supportive Culture: Enjoy a supportive and inclusive work environment where your ideas are valued, and your contributions make a real impact.
• Community Focus: Be part of a company that understands the importance of small and mid-sized businesses to their communities and the nation’s financial health.
• High-Performing Team: Join a team of badasses who are committed to excellence and are integral to our company's expansion and success.

About the Role

As our data, systems, and partner relationships grow, we're in need of a Privacy & Data Governance Director to strengthen and run our privacy and data governance program.

This person will turn written policy into enhanced controls that actually operate across our platforms, including Salesforce, AWS, and other collaboration tools. They'll set the rules for how we classify, retain, anonymize, and delete data. They'll also set guardrails for new data risks, including AI tools. The role will work closely with Legal, Risk, Operations, Engineering, and IT/Security.

Responsibilities

• Own the data classification policy and establish governance over the inventory of confidential and restricted data across systems, vendors, and data flows.
• Maintain privacy policies, procedures, and standards that match applicable law, partner requirements, and our own risk appetite.
• Run privacy impact assessments for new products, systems, vendors, and major changes.
• Support successful completion of SOC 2 audits.
• Assist with third-party reviews to ensure proper alignment with privacy and data governance requirements.
• Lead the retention program, including retention schedules, legal holds, and secure disposal and media sanitization.
• Partner with Engineering to specify retention and deletion controls inside production systems, and confirm they work as designed.
• Write and maintain governance standards for generative AI tools, covering acceptable use, what data may go into prompts, and vendor review.
• Help set requirements for data loss prevention (DLP) and data discovery tools.
• Test privacy and data controls in key systems.
• Track gaps and remediation and report status and risk trends to senior leadership.
• Serve as the privacy point of contact for audits, bank partner reviews, and regulatory exams.
• Assist in building privacy and data-handling training for employees and new hires.

• 7+ years in privacy, data governance, information security compliance, or a related field. At least 3 years should be in financial services, fintech, or another regulated industry.
• US CIPP (Certified Information Privacy Professional) and/or CRCM (Certified Regulatory Compliance Manager) certification preferred.
• Hands-on experience building or significantly enhancing a privacy or data governance program, including data classification, data inventories, and retention schedules.
• Core knowledge and applicable experience with U.S. privacy and record-retention requirements relevant to lending. Examples include CCPA/CPRA, GLBA, ECOA/Reg B record retention, BSA/AML recordkeeping, and state data-breach laws.
• Understanding of de-identification, pseudonymization, and deletion methods, and the legal and technical tradeoffs among them.
• Experience testing controls or supporting audits (SOC 2, internal audit, or regulatory exams).
• Comfort working with technical teams: reading system configurations, writing clear requirements, and following remediation through ticketing tools such as Jira.
• Excellent written communication.

• Competitive salary
• Health insurance
• Growth and development opportunities
• Dynamic and collaborative work environment
• Company events and team-building activities