Data Privacy, Cybersecurity & AI Compliance Manager

Job description

**Title**:  Data Privacy, Cybersecurity & AI Compliance Manager **Location**: Austin, TX / Dallas, TX / Morristown, NJ (Hybrid) **Reporting to**: Sr. Enterprise Compliance Director **About Hippo:** Hippo was built on a promise: make homeownership effortless. Nearly a decade later, that mission still drives us. We use technology and data to help our customers stay ahead of problems and protect what matters most. Today, that same tech-native approach powers our work beyond homeowners. Hippo operates as a diversified carrier platform, partnering with MGAs to deliver tailored program solutions that help them grow and deliver better customer experiences. Behind that work is a team that values ownership, curiosity, collaboration, and continuous improvement. If you're energized by building what's next, we'd love to meet you. **About You:** You are a compliance professional who lives at the intersection of data privacy, cybersecurity, and AI governance. You're not necessarily an attorney, but you know how to translate complex regulatory requirements into practical, operational compliance programs, and you know when an issue needs to go to Legal for interpretation or sign-off. You've built or matured compliance programs against frameworks like the CCPA/CPRA and other state privacy laws, the TCPA and related marketing rules, the NYDFS Cybersecurity Regulation (23 NYCRR 500), the NAIC Insurance Data Security Model Law, and emerging AI regulations (e.g., Colorado AI Act, EU AI Act, NAIC AI model bulletins). You're as comfortable running day-to-day privacy operations, working a live security incident alongside InfoSec, or writing a quarterly report for a board committee as you are designing the program those activities live in. Insurance industry experience is a strong plus, since you understand the regulatory overlay carriers and producers face beyond standard corporate compliance. You're detail-oriented, comfortable managing multiple regulatory threads at once, and skilled at partnering across Legal, Security, Engineering, Marketing, and the business to keep Hippo ahead of a fast-moving regulatory landscape. **What You'll Do:** - **Privacy Program Build & Ownership:** Design, build, and run Hippo's enterprise data privacy compliance program, maturing it from today's operational footing into a documented, auditable program: governance and accountability structure, data inventory and records of processing, privacy impact assessment process, policy framework, program metrics, and a regulatory change management process covering CCPA/CPRA, other state privacy laws, and insurance-specific privacy requirements (e.g., GLBA and state insurance privacy laws) - **Privacy Operations & Consumer Rights:** Own Hippo's privacy mailbox and consumer rights request process end to end: intake, verification, tracking, and timely response to access, deletion, correction, and opt-out requests, with documentation sufficient to withstand regulatory scrutiny - **Marketing & Advertising Compliance:** Own compliance for marketing and outreach channels, including TCPA/telemarketing and SMS consent requirements (CTIA messaging standards, consent capture and logging, opt-out handling), CAN-SPAM, and website tracking technologies (cookies, pixels, session replay) and consent management; partner with Marketing and Growth teams on campaign and disclosure review - **Cybersecurity Regulatory Compliance:** Support compliance with insurance-specific cybersecurity regulations (NYDFS 23 NYCRR 500, NAIC Insurance Data Security Model Law and state adoptions) and general frameworks (e.g., NIST); support annual certifications, risk assessments, and regulatory exams and audits, and maintain required documentation - **Cyber Event Handling:** Partner with Information Security on the triage, investigation, containment, and resolution of cyber events; own the compliance workstream for each event, including documentation, materiality and notification analysis support (state breach statutes, NYDFS 72-hour reporting), and remediation tracking, escalating legal determinations to counsel - **AI Governance & Compliance:** Build and maintain Hippo's AI compliance framework, including use case intake, risk assessment, inventory, and monitoring for AI/ML systems across the business; track state, federal, and international AI regulation relevant to insurance (algorithmic accountability, AI in underwriting, claims, and pricing, model governance requirements) - **Vendor & Third-Party Risk:** Conduct privacy and data-protection reviews of vendors and third-party service providers, support the data processing agreement process with Legal, and partner with InfoSec on third-party security diligence, including NYDFS Section 500.11 TPSP requirements - **Policies, Standards & Training:** Draft, maintain, and operationalize internal policies, standards, and procedures for data privacy, cybersecurity, and AI use, and develop and deliver company-wide training and awareness on those policies, in coordination with the Sr. Enterprise Compliance Director and Legal - **Regulatory Liaison Support:** Serve as a day-to-day point of contact for regulatory inquiries, exams, and audits touching privacy, cyber, and AI, coordinating responses and escalating legal interpretation questions to attorney oversight - **Cross-Functional Partnership:** Work closely with Legal, Information Security, Engineering, Marketing, and business units to embed privacy, security, and AI compliance requirements into products, processes, and vendor relationships **Must Haves:** - 5+ years of experience in data privacy, cybersecurity, and/or AI governance compliance within a regulated industry, including hands-on operational experience (consumer rights requests, incident response, marketing compliance), not just policy work - Bachelor's degree; one or more relevant certifications strongly preferred: CIPP/US, CIPM, or CIPT (IAPP privacy certifications), AIGP (IAPP Artificial Intelligence Governance Professional), CISSP, CISM, CRISC, or CDPSE - Demonstrated experience building or significantly maturing a privacy or compliance program, not solely running an established one - Working knowledge of key privacy, marketing, and cybersecurity regulatory frameworks (CCPA/CPRA and other state privacy laws, TCPA, GLBA, NYDFS 23 NYCRR 500, NAIC Insurance Data Security Model Law) - Familiarity with the emerging AI regulatory landscape and how it applies to insurance use cases (underwriting, claims, pricing, customer service) - Experience supporting security incident response and breach notification analysis in partnership with information security and legal teams - Strong written communication skills, including experience preparing reporting for senior management, board, or committee audiences - Experienced working in close partnership with legal counsel and knows when to escalate for legal interpretation