Senior Privacy Analyst

Upbound Group

Upbound Group (NASDAQ: UPBD) is a technology and data-driven leader in accessible financial solutions, serving millions of consumers through trusted brands including Acima®, Brigit™, and Rent-A-Center®. More than just a financial services company, we're a purpose-driven team focused on expanding financial inclusion, creating opportunities, and helping people achieve what's possible. Our mission is simple: leverage innovation, technology, and talent to build a better future and elevate financial opportunity for all.

Senior Privacy Analyst

Job Purpose

The Senior Privacy Analyst is the senior operating role on the Upbound privacy team. Working under the Director of Privacy/ Data Protection Officer (DPO), this role leads day-to-day execution of the privacy program across the company’s brands and subsidiaries. The role turns program strategy into repeatable assessments, vendor reviews, data inventories, AI governance records, and metrics that stand up to regulators, auditors, and executives. The Senior Privacy Analyst operates with limited supervision, owns assessment quality and record integrity, and guides the Privacy Analyst I. The role gives Legal, Information Security, GRC, Procurement, Product, and brand leaders clear, risk-based recommendations, and supports operational integration of subsidiaries into the enterprise privacy program under the DPO’s direction.

How This Role Fits

• DPO and Director of Privacy: retains accountability for program strategy and oversight; approves policies and assessments; makes final risk, exception, and escalation decisions; approves vendor DPAs; and owns regulator engagement.
• Senior Privacy Analyst: leads day-to-day operations, prepares risk-based recommendations, and maintains the quality of assessments, records, and reporting for DPO review and oversight.
• Privacy Analyst I: executes intake, request handling, assessment support, inventory upkeep, and evidence collection under the Senior Privacy Analyst's guidance.

Key Responsibilities

Privacy Risk Management and Assessments

• Lead data mapping and data flow analysis across brands and subsidiaries, and maintain the data inventory and records of processing in Securiti.ai and OneTrust.
• Lead Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) for systems, vendors, products, and processing activities. Assist Analyst I in review submissions for completeness, data minimization, retention, consumer rights, sensitive data, and incident response capability.
• Assign and document risk ratings, maintain the privacy risk register, and prepare approval, conditional approval, escalation, or rejection recommendations for final DPO decision and sign-off.
• Embed privacy by design with Product, Engineering, and Technology teams through early design reviews and defined DPIA triggers.

Third-Party Privacy Risk and Data Processing Agreements

• Lead privacy due diligence for new and existing vendors across onboarding, renewals, material scope changes, reassessments, and lookback initiatives.
• Review and redline Data Processing Agreements (DPAs) against the Upbound DPA Standard, track deviations, and partner with Legal and Procurement to resolve them before onboarding or renewal. Escalate material or non-negotiable deviations to the DPO for final approval or rejection.
• Evaluate vendor questionnaires, SOC reports, and certifications with Information Security and GRC. Assess vendor use of AI, automated decision-making, sensitive data, tracking technologies, and subprocessors.
• Manage vendor privacy workflows, evidence, exceptions, remediation plans, and reassessment dates in OneTrust, and support offboarding, including data return and deletion.
• Track vendor breach notification obligations and support the Third-Party Incident Response Playbook.

AI Governance Operations

• Maintain the enterprise AI inventory and governance tracker, including use cases, risk tiers, assessment status, controls, exceptions, remediation, review dates, vendor commitments, and decisions.
• Prepare AI impact assessments, disclosures, human oversight documentation, monitoring records, and incident escalations under applicable requirements.
• Research emerging AI laws, enforcement, standards, and guidance; summarize impacts and recommended actions for the DPO.
• Maintain governance evidence and prepare dashboards, briefings, and escalation materials for the DPO and relevant committees.
• Coordinate implementation of DPO-approved AI governance requirements across Legal, Security, Product, Engineering, Procurement, and business teams; the DPO retains final authority over risk acceptance, exceptions, escalations, and program direction.

Consumer Rights, Data Lifecycle, and Controls

• Lead the individual rights workflow in Securiti.ai, including quality review of complex and escalated requests, SLA tracking, and metrics and assisting Analyst I
• Oversee cookie and tracking technology governance with Lokker and Securiti.ai, including coverage across all brands.
• Drive retention and disposal initiatives, including data and physical-records purge activities, under approved retention schedules
• Partner with IT and Security on DSPM, Microsoft Purview, data classification, and DLP, and translate privacy requirements into clear technical specifications.

Incident Response, Assurance, and Reporting

• Support privacy incident response, including breach analysis, state notification timeline tracking, evidence handling, and post-incident reviews.
• Help plan and run privacy tabletop exercises with Legal, IT, Communications, and brand leadership.
• Build and maintain privacy KPIs, dashboards, assessment registers, DPA trackers, and audit evidence for leadership, the Data and AI Governance Committee, and auditors.
• Monitor changes in state privacy laws, AI laws, and regulatory guidance, and brief the DPO on recommended program changes for the DPO’s direction and approval.

Subsidiary Integration

• Lead operational integration of subsidiaries into the privacy program under the DPO’s direction, including data flow mapping, a dedicated DPIA, privacy notice review, and alignment of vendor, individual rights, and incident processes.
• Prepare analysis for the DPO and Legal on GLBA and FTC Safeguards Rule applicability and state law exemptions across brands.

Leadership and Program Development

• Guide and mentor the Privacy Analyst I through work assignments, quality review, and skill development.
• Develop and maintain procedures, standards, checklists, templates, and training content, and support the annual privacy training program.
• Serve as a working point of contact for Brand Privacy Leads and represent Privacy in cross-functional working groups only as delegated by the DPO, without displacing the DPO’s decision authority or accountability.

Key Skills

• Advanced knowledge of privacy risk management, PIAs and DPIAs, privacy by design, and third-party privacy risk.
• Strong command of U.S. state privacy laws, GLBA, the FTC Safeguards Rule, breach notification requirements, and emerging AI, automated decision-making, and biometric laws. Familiarity with Mexico's LFPDPPP is a plus.
• Ability to review and redline DPAs and to interpret vendor security evidence such as SOC reports and certifications.
• Hands-on experience with privacy and governance platforms such as OneTrust, Securiti.ai, and Microsoft Purview.
• Working technical fluency in cloud environments, APIs, cookies and tracking technologies, data classification, DLP, and access management.
• Strong analytical judgment to separate material from non-material findings and communicate defensible recommendations.
• Excellent written and verbal communication for executives, attorneys, engineers, and vendors.
• Ability to manage competing priorities, own deadlines, and coach junior team members.
• Did opAbility to support AI governance through use-case tracking, risk tiering, impact assessments, regulatory research, evidence management, and concise reporting to the DPO and governance committees.

Job Requirements

• Bachelor's degree in Privacy, Law, Compliance, Information Technology, Cybersecurity, Risk Management, Business, Data Analytics, or a related field. Equivalent relevant experience may be considered.
• Five or more years of experience in privacy, third-party risk management, compliance, information security, or a related field.
• Demonstrated experience conducting PIAs, DPIAs, and vendor privacy risk assessments.
• Demonstrated experience reviewing, drafting, or negotiating DPAs and related data protection terms.
• Experience managing assessment workflows, evidence, remediation, and reassessments in OneTrust or a comparable platform.
• Experience supporting AI governance activities, including inventory or use-case tracking, impact assessments, monitoring, regulatory research, documentation, or governance reporting.
• Experience in financial services, fintech, or consumer finance is preferred.
• Professional certification such as CIPP/US, CIPM, CIPT, or AIGP is preferred.

Location

On-site at our Corporate Headquarters in Plano, TX