Associate Compliance Privacy Director

Summary/Job Purpose

The Associate Compliance Privacy Director will support and advance Exelixis' privacy compliance program as a privacy subject matter expert and point of contact. This role partners with cross-functional teams to ensure enterprise-wide compliance with U.S. and global privacy and data security requirements, including the EU General Data Protection Regulation (GDPR), clinical trial regulations, and HIPAA obligations for the employee group health plan.

Essential Duties/Responsibilities

• Provide strategic and operational privacy support across the company, and as designated Compliance representative on Information Governance Council and privacy control for relevant business processes, including incident response and management, information and data governance, and data security.
• Develop a deep understanding of how data is used across Exelixis' products, teams and research; document, and implement privacy requirements for new products and initiatives.
• Develop, document, and maintain privacy operations processes and procedures.
• Assist with the development and maintenance of privacy training and awareness programs for functions, new hires, and key stakeholders.
• In collaboration with, and at the direction of Legal Affairs, conduct and complete internal investigations of privacy matters, including providing support on any corrective action.
• Monitor and assess the impact of evolving U.S. federal and state privacy and data security laws, regulatory guidance, and enforcement trends on Exelixis' business operations and privacy compliance program.
• Develop the report on privacy compliance program key performance indicators and metrics to senior leadership.
• Partner with global clinical trial operations in implementing data protection requirements, including data transfer mechanisms, personal data notices, consent language, and data processing controls.
• In collaboration with Legal Affairs, provide guidance on HIPAA compliance requirements for the company's group health plan, coordinating efforts with HR and benefits administrators.
• Conduct and manage privacy and data impact assessments, as needed.
• Support cross-border data transfer compliance, including documenting transfer impact assessments and other requirements under SCCs, UK IDTA, and other mechanisms.
• Manage data subject rights requests, coordinate data review and responses across relevant functions and maintain compliance documentation.
• Collaborate with Legal Affairs and Information Technology (IT) on incident response and breach notification processes.
• Align with Legal Affairs on preferred privacy-related and data security-related contract terms and provisions.
• Partner with IT to operationalize data protection requirements into business processes, policies, and administrative and technical controls.
• Analyze privacy impact of, and recommend appropriate controls for, initiatives leveraging Artificial Intelligence (AI), biometrics, and emerging technologies.
• Manage data processing activities and respond to data subject and regulator's inquiries.
• Incorporate Privacy by Design (PbD) principles into work products, processes, and decision-making.
• Define, scope, and execute technical frameworks for website tracking privacy to align marketing technologies (MarTech) with global privacy regulations.
• Build strong, collaborative relationships with key stakeholders across the organization.
• Participate in working groups, governance committees, and cross-functional initiatives that have a privacy and data security impact.

Education/Experience/Knowledge/Skills & Abilities

Bachelor's degree in related discipline and 11 years of relevant experience; or equivalent combination of education and years of experience. CIPP/US, CIPP/E, CIPM or similar certification preferred.

Minimum of 11 years professional experience, including 9 in privacy or data protection in a life sciences, biotech, pharma, or medical device industry required, with a focus on program operations and governance, risk, and compliance activities. Minimum of 2 years project management experience in a matrixed organization.

Knowledge, Skills and Abilities Required

• Excellent interpersonal communication, collaboration, project management, and stakeholder management skills.
• Ability to develop and deliver clear and concise presentations.
• Ability to think strategically with a proactive, risk-based approach.
• Ability to exercise sound ethical judgment and consistently uphold data protection principles.
• Ability to devise creative business solutions for complex problems.
• Effectively manages ambiguity, handling multiple tasks simultaneously and adjusting priorities quickly.
• Highly organized, detail-oriented, and analytically rigorous.
• Must be a self-starter and quick learner.
• Strong computer skills (e.g., Microsoft Office Suite, document comparison programs, and Internet).