Senior Privacy Analyst

LastPass is looking for a Senior Privacy Specialist: 

As a Privacy Specialist for LastPass, you will be responsible for ensuring the organization's compliance with data protection laws and regulations, as well as implementing and maintaining robust privacy practices. You will play a crucial role in safeguarding sensitive information, promoting a culture of privacy awareness, and mitigating privacy risks.  

If you are passionate about user privacy, have a keen eye for security and a strong technical background, and you thrive in a collaborative and innovative environment, then this is the role for you.  

Who will you work with? 

As a Privacy Specialist, you will collaborate with a diverse range of stakeholders within the organization to ensure the effective implementation of privacy practices and compliance. Your interactions will span across various departments, including Legal and GRC Compliance, Security, IT, Procurement, HR and Executive Leadership in Hungary, Portugal, and the United States of America. 

What are some of the exciting challenges you will be working on? 

Privacy Policy Implementation 

• Implement privacy policies, guidelines, best practices, and procedures in alignment with applicable data protection laws and industry best practices, aligning with existing GRC guidance. 
• Performing quarterly and ad hoc reviews of externally facing privacy documentation on the LastPass Trust and Privacy Center pages. Ensuring all updates are published timely. 

Privacy Compliance Management 

• Conducting privacy risk and impact assessments of new and existing LastPass products, services, and processes and document results.  
• Continuously maintaining privacy controls documentation and related evidence necessary to demonstrate compliance with applicable laws and regulations. Providing evidence as required to third-party auditors or other compliance audits. 
• Conduct privacy impact assessments (PIAs) and audits to identify and address potential privacy risks. 
• Supporting the completion of DPIAs and pre-DPIAs by regulatory requirements. 
• Working closely with the Data Protection Officer and other Legal team members to identify trends in privacy and regulatory requirements and compliance enforcement and drive necessary changes in the data privacy program.  
• Work with the Security, Legal, Sales, and Support/Care team members to respond to customer assessment requests and inquiries relating to privacy management. 
• Support the buildout of tooling and system integrations for handling data subject access requests (DSARs) and requests related to data privacy rights. 

Data Mapping and Inventory 

• Maintaining and providing training on LastPass Privacy platforms, including ensuring detailed data inventories and data flow mappings across each product’s data processing activities are kept up-to-date and accurate. 
• Collaborate with relevant teams to create and maintain a comprehensive data inventory, documenting the flow and handling of personal information. 
• Conduct regular assessments to ensure the accuracy and completeness of data maps. 

Vendor and Third-Party Management 

• Evaluate and advise the privacy procedures of third-party vendors and external data processors during integrations and ongoing internal audits, guaranteeing adherence to our privacy frameworks. 

What does it take to work at LastPass? 

• Background in law, information security, privacy, or a related field. 
• Proven experience as a Privacy Specialist or similar role, with a focus on privacy compliance, preferably in a regulatory environment or a large organization. 
• In-depth knowledge of global privacy laws and regulations, such as GDPR, CCPA, and other relevant frameworks. 
• Experience with Data Inventory and Mapping tools 
• Excellent communication and interpersonal skills. 
• Strong analytical problem-solving skills, team player, and can-do attitude. 
• Ability to communicate comfortably with different stakeholder groups with different backgrounds and technical understanding within LastPass. 
• Good written and verbal communication skills in English. 

It's great, but not required: 

• Experience with privacy and system inventory tools, no-code automation systems 
• Certifications such as Certified Information Privacy Technologists (CIPT) or similar (CIPP, CIPM, or ISACA CDPSE). 
• Experience working with global teams.