Principal Compliance Lead, Security (COPPA & GDPR Control Testing)

Role overview

Lead the design and operation of a security control testing programme that demonstrates how privacy requirements are applied across digital products used by children, teens, and adults. This senior role translates GDPR, UK GDPR, and COPPA obligations into testable controls, coordinates remediation across technical and legal teams, and prepares the organisation to demonstrate compliance to auditors and regulators.

Responsibilities - Convert privacy and children’s data requirements into specific security controls, then run recurring tests using sampling, evidence collection, and re-performance. - Assess controls across apps, websites, software development kits, analytics, advertising, and third-party integrations. - Verify safeguards such as age screening, parental consent, data minimisation, retention and deletion, and parental access for users under 13. - Own security input for data protection by design and security of processing; test related processes for data requests, processing records, retention, and international transfers. - Contribute to impact assessments and supplier reviews, and keep incident notification processes ready for required deadlines. - Track issues through resolution with product and engineering owners; report control performance, lead audit and regulator responses, monitor regulatory changes, and coach junior colleagues.

Requirements - At least 10 years in security compliance, governance, risk, privacy engineering, or technology risk, including 4 or more years in a senior or lead role. - Practical experience testing COPPA controls, including age screening, consent, and handling children’s data. - Working knowledge of GDPR and UK GDPR as they apply to engineering and security, including Articles 25, 30, 32, 33, and 35. - Ability to translate legal requirements into testable controls and operate a documented, audit-ready testing programme. - Experience with at least one of NIST CSF or Privacy Framework, ISO 27001/27701, or SOC 2. - Understanding of cloud, mobile, and web data flows, identity and access management, encryption, logging, and retention; relevant degree or equivalent experience.

Nice to have - Experience with consumer services used by young audiences, including media, gaming, education technology, or financial products. - Familiarity with COPPA Safe Harbor programmes, the UK Age-Appropriate Design Code, consent or data-mapping tools, and data-subject-request automation. - Relevant privacy, audit, or security certifications, or experience responding to regulatory inquiries.

Benefits and work setup - Base compensation of $205,000–$256,000, plus a 15% bonus and equity. - Medical, dental, vision, life insurance, health savings account contributions, and a 401(k) with company match. - Flexible vacation, paid holidays, and company-provided technology; relocation assistance may include travel and housing for the first 90 days.