[Hiring] Privacy and Compliance Specialist @Virta Health

Role Description

Virta's Legal team seeks a Privacy & Compliance Specialist to own the day-to-day execution of privacy operations, manage cross-functional compliance projects and serve as a primary point of contact for privacy-related customer and partner inquiries. This individual will work closely with Legal, Engineering, Product, Security, and Commercial teams to maintain and strengthen Virta's privacy posture as the company scales. The role is high-impact and high-autonomy, designed for a subject matter expert who thrives at the intersection of privacy law, project management, and health tech operations.

Responsibilities

• Privacy Program Operations:
  • Manage and maintain Virta’s privacy compliance program, including policies, procedures, and documentation.
  • Conduct and coordinate privacy impact assessments (PIAs/DPIAs) and data protection assessments for new products, features, and vendor relationships.
  • Maintain records of processing activities (RoPA), data inventories, and data flow maps.
  • Monitor and operationalize requirements under HIPAA, state privacy laws (CCPA/CPRA and other state comprehensive privacy laws), and other applicable frameworks.
  • Implement and support Privacy by Design across all aspects of Virta’s business.
  • Support data subject rights requests (DSARs) and privacy incident response workflows.
• Customer and Partner Privacy Support:
  • Serve as a primary point of contact for privacy and data-related inquiries from customers, prospects, and partners.
  • Draft and maintain responses to privacy questionnaires, RFPs, security assessments, and due diligence requests.
  • Support the negotiation and review of Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs).
• Project Management and Cross-Functional Coordination:
  • Drive privacy and compliance initiatives from planning through execution, managing timelines, stakeholders, and deliverables.
  • Develop and deliver privacy training and awareness programs across the organization, fostering a culture of respect for protected health information and other categories of protected data.
  • Build and maintain privacy metrics, dashboards, and reporting for leadership and Board visibility.
  • Identify opportunities to improve and automate privacy processes and workflows.

90 Day Plan

• Get up to speed on Virta’s privacy program, existing policies, data flows, and key stakeholders across Legal, Engineering, Product, Security, and Commercial teams.
• Take ownership of the privacy impact assessment process and complete at least one PIA/DPIA for a current initiative.
• Assume management of incoming privacy questionnaires, RFPs, and customer/partner privacy inquiries, establishing repeatable response workflows.
• Review existing DSAR and privacy incident response workflows and identify concrete improvement opportunities.
• Begin building privacy metrics and reporting to provide leadership with visibility into program performance and risk posture.

Qualifications

• 4 to 7 years of experience in privacy, compliance, data protection, or a related field.
• Working knowledge of HIPAA, state consumer privacy laws (including CCPA/CPRA), and health data regulations.
• Demonstrated project management skills with the ability to manage multiple workstreams simultaneously.
• Experience with privacy impact assessments, incident response, or data subject request (DSAR) workflows.
• Strong written and verbal communication skills, with the ability to translate complex privacy requirements into practical guidance.
• Demonstrates a proactive use of AI tools to improve individual output and efficiency.

Values-driven culture

• You put people first and take care of yourself, your peers, and our patients equally.
• You have a strong sense of ownership and take initiative while empowering others to do the same.
• You prioritize positive impact over busy work.
• You have no ego and understand that everyone has something to bring to the table regardless of experience.
• You appreciate transparency and promote trust and empowerment through open access of information.
• You are evidence-based and prioritize data and science over seniority or dogma.
• You take risks and rapidly iterate.

Compensation

Virta has a location-based compensation structure. Starting pay will be based on a number of factors and commensurate with qualifications & experience. For this role, the compensation range is $100,000 to $120,000.

Additional Information

As part of your duties at Virta, you may come in contact with sensitive patient information that is governed by HIPAA. Throughout your career at Virta, you will be expected to follow Virta's security and privacy procedures to ensure our patients' information remains strictly confidential. Security and privacy training will be provided.

As a remote-first company, our team is spread across various locations with office hubs in Denver and San Francisco.

Virta uses Ashby as its applicant tracking system, which incorporates AI-powered tools (provided by OpenAI, AWS, and Google Gemini) in certain aspects of the recruiting process, including application review, candidate screening, and interview note taking; your data is not used to train AI models, and all final hiring decisions are made by Virta Health personnel.