[Hiring] Program Manager, Privacy @H&R Block Management

Role Description

Assist with the operational oversight, execution, and continuous improvement of H&R Block’s Privacy Program as it applies to the Wave and Block small business services segments (the “Program”). Help ensure that appropriate policies, procedures, training, and controls are implemented and maintained for the collection, storage, use, disclosure, and disposal of business customer data and individuals’ personal information (as applicable). Provide subject matter expertise and support cross functional work (e.g., with Legal, Technology, Information Security, Compliance, Strategic Sourcing, and business operations teams) to operationalize privacy requirements, support responsible data use, and reduce privacy risk. Educate associates regarding privacy risks and Program requirements to promote and enhance a privacy-focused culture. Overall, promote a practical, business-oriented privacy culture that supports customer trust and enables the company to deliver services to small business customers in a compliant and responsible manner.

Day to Day, you'll:

• Help define, execute, and continuously improve the Program strategy, roadmap, operating model, and priorities to ensure alignment with the strategic objectives of the business and the company’s small business services model.
• Update, implement, and maintain privacy-related policies, procedures, standards, playbooks, and controls to support compliance with applicable privacy, data protection, and data security requirements.
• Lead (or as applicable assist with) initiatives to mitigate risks associated with the collection, storage, use, disclosure, and disposal of business customer data and individuals’ personal information.
• Evaluate and support the responsible use of artificial intelligence to benefit small business customers and improve the efficiency/productivity of Program-related processes, procedures, and tasks.
• Update, execute and continuously improve training and awareness initiatives for the Program, incorporating best practices to maximize engagement and effectiveness.
• Provide project management expertise and lead cross functional teams in the analysis and implementation (where appropriate) of operational changes to comply with legal/regulatory requirements applicable to the Program.
• Assist in incident response scenarios to help ensure a timely and appropriate company response. This may include coordination with internal teams, investigation support, remediation activities and communications with business customers, individuals, or regulators as needed.
• Lead and coordinate privacy impact assessments for new products, features, integrations, marketing initiatives, vendor engagements, and internal business processes (including as applicable the assessment of artificial intelligence).
• Support supplier risk management for the Program by reviewing new vendors, renewals, data sharing arrangements, contract privacy terms, security review status, onboarding, offboarding, and ongoing remediation for third parties that access or process personal information.
• Administer and improve processes for consumer, employee, and business customer privacy requests, including access, deletion, correction, opt-out, consent, and other rights requests submitted through privacy management tools or customer support channels.
• Partner with Product, Technology, Data, Marketing, Sales, and Customer Support teams to embed privacy-by-design principles into digital products, customer support workflows, analytics, advertising, integrations, and data governance practices.
• Develop and maintain Program metrics to enable monitoring and measurement against Program objectives and key risk indicators.
• Present to the Enterprise Risk Committees and others as needed regarding Program-related objectives, priorities, and issues. Coordinate Program activities with senior leadership and sponsorship teams.
• Manage the Program budget in accordance with the company’s established budgeting and forecasting process.

Qualifications

• Bachelor’s degree in a related field (e.g., Business, Technology, Information Security, or Management)
• 8 years of experience in a data privacy or information security role or similar experience in privacy, technology, information security, compliance, audit, or program management
• Working knowledge and operational understanding of privacy and data protection principles, laws, and regulations relevant to B2B small business services, including data breach notification laws, marketing and consent requirements, vendor oversight, and cross-border data transfer considerations
• Demonstrated ability to manage multiple priorities, meet deadlines, maintain accurate documentation, and report status and metrics to leadership
• Sound judgment, attention to detail, discretion with sensitive information, and a practical risk-based approach to balancing compliance, customer trust, and business enablement
• Project management experience and skills, including the ability to plan work, manage dependencies, track deliverables, escalate risks, and drive execution through cross-functional teams
• Strong history of building robust internal and external connections and relationships
• Ability to influence and lead without direct authority and matrix management skills and ability to oversee tasks delegated to others
• Experience conducting or reviewing privacy impact and risk assessments
• Understanding of information security controls and sensitive data protection approaches and countermeasures
• Excellent oral, written, and interpersonal communication skills
• Strong presentation and facilitation skills to communicate with and persuade a wide range of audiences, including business leaders
• Experience developing and managing program budgets

Preferred Qualifications

• 10 or more years of experience in a data privacy or information security role in the financial and/or small business services industries
• Privacy certification (e.g., CIPP), highly preferred
• Project management certification (e.g., PMP)
• Experience conducting or coordinating privacy impact assessments, vendor privacy reviews, data mapping, data sharing reviews, data rights request workflows, incident response activities, or privacy control testing
• Demonstrated success in a risk management, compliance, legal, or audit role
• Small business services, tax, or financial background
• Graduate degree (e.g., MBA)

Benefits

• Competitive pay
• Comprehensive benefits
• Support for life both in and outside of work