Privacy and Compliance Specialist

Virta's Legal team seeks a Privacy & Compliance Specialist to own the day-to-day execution of privacy operations, manage cross-functional compliance projects and serve as a primary point of contact for privacy-related customer and partner inquiries. This individual will work closely with Legal, Engineering, Product, Security, and Commercial teams to maintain and strengthen Virta's privacy posture as the company scales. The role is high-impact and high-autonomy, designed for a subject matter expert who thrives at the intersection of privacy law, project management, and health tech operations.

Responsibilities

The Privacy & Compliance Specialist will be responsible for the following areas of work:

Privacy Program Operations

• With supervision from the Sr. Corporate Counsel and Privacy Officer, manage and maintain Virta’s privacy compliance program, including policies, procedures, and documentation.
• Conduct and coordinate privacy impact assessments (PIAs/DPIAs) and data protection assessments for new products, features, and vendor relationships.
• Maintain records of processing activities (RoPA), data inventories, and data flow maps.
• Monitor and operationalize requirements under HIPAA, state privacy laws (CCPA/CPRA and other state comprehensive privacy laws), and other applicable frameworks.
• Implement and support Privacy by Design across all aspects of Virta’s business.
• Support data subject rights requests (DSARs) and privacy incident response workflows.

Customer and Partner Privacy Support

• Serve as a primary point of contact for privacy and data-related inquiries from customers, prospects, and partners.
• Draft and maintain responses to privacy questionnaires, RFPs, security assessments, and due diligence requests.
• Support the negotiation and review of Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs).

Project Management and Cross-Functional Coordination

• Drive privacy and compliance initiatives from planning through execution, managing timelines, stakeholders, and deliverables.
• Develop and deliver privacy training and awareness programs across the organization, fostering a culture of respect for protected health information and other categories of protected data.
• Build and maintain privacy metrics, dashboards, and reporting for leadership and Board visibility.
• Identify opportunities to improve and automate privacy processes and workflows.

90 Day Plan

Within your first 90 days at Virta, we expect you will do the following:

• Get up to speed on Virta’s privacy program, existing policies, data flows, and key stakeholders across Legal, Engineering, Product, Security, and Commercial teams
• Take ownership of the privacy impact assessment process and complete at least one PIA/DPIA for a current initiative
• Assume management of incoming privacy questionnaires, RFPs, and customer/partner privacy inquiries, establishing repeatable response workflows
• Review existing DSAR and privacy incident response workflows and identify concrete improvement opportunities
• Begin building privacy metrics and reporting to provide leadership with visibility into program performance and risk posture

Must-Haves

• 4 to 7 years of experience in privacy, compliance, data protection, or a related field
• Working knowledge of HIPAA, state consumer privacy laws (including CCPA/CPRA), and health data regulations
• Demonstrated project management skills with the ability to manage multiple workstreams simultaneously
• Experience with privacy impact assessments, incident response, or data subject request (DSAR) workflows
• Strong written and verbal communication skills, with the ability to translate complex privacy requirements into practical guidance
• Demonstrates a proactive use of AI tools to improve individual output and efficiency

Values-driven culture

Virta’s company values drive our culture, so you’ll do well if:

• You put people first and take care of yourself, your peers, and our patients equally
• You have a strong sense of ownership and take initiative while empowering others to do the same
• You prioritize positive impact over busy work
• You have no ego and understand that everyone has something to bring to the table regardless of experience
• You appreciate transparency and promote trust and empowerment through open access of information
• You are evidence-based and prioritize data and science over seniority or dogma
• You take risks and rapidly iterate