Privacy & Compliance Program Manager

Thunderbird is growing beyond our free desktop and mobile applications, and we’re looking for a Senior Privacy & Compliance Program Manager to help build and strengthen the privacy, compliance, data governance, and vendor review practices that support MZLA’s products and operations. Privacy and compliance are central to how we build and maintain user trust, particularly for a global user base with a significant presence in Europe. As MZLA expands its products and services, this role will help ensure that data is collected, used, shared, retained, and governed responsibly, in line with Thunderbird’s values and user trust commitments. You will help translate privacy, security, and compliance requirements into practical processes that fit our products and services, infrastructure, support workflows, vendor ecosystem, and operating model. What you’ll do: - Coordinate MZLA’s privacy and compliance program work, including planning, recurring reviews, risk tracking, documentation, and leadership reporting. - Translate privacy, security, and compliance requirements into practical processes that fit how MZLA works. - Coordinate vendor and tool reviews with legal, engineering, product, support, finance, operations, and other stakeholders. - Help document data flows, subprocessors, and privacy, security, contractual, and operational considerations. - Support privacy operations and data governance for a global user base, including DSAR and privacy-rights workflows. - Help develop and maintain practical data inventories, records of processing, retention practices, and privacy-related documentation. - Partner with technical teams to support privacy-by-design practices for new products, services, tools, and data-processing activities. - Support compliance and audit-readiness efforts, including ISO-related readiness, evidence tracking, access reviews, and remediation follow-up. - Help strengthen incident response readiness by clarifying roles, escalation paths, documentation expectations, and coordination needs. - Build lightweight guidance, checklists, templates, and training materials that help teams meet privacy and compliance expectations without creating unnecessary bureaucracy. What you bring: - 8+ years of relevant professional experience, preferably within a software, SaaS, technology, or technical product environment. - 5+ years of direct or closely related hands-on experience in privacy operations, compliance program management, GRC, legal operations, security compliance, vendor governance, data governance, or a similar function. - Experience coordinating cross-functional programs across legal, engineering, product, support, finance, and operations teams. - Experience supporting vendor, tool, or subprocessor reviews. - Experience supporting privacy operations, data governance, or user-rights workflows for products or services with international users (GDPR, EU privacy requirements, DSARs). - Technical fluency to understand how data moves through systems (cloud services, vendor tools, logs, telemetry). - Familiarity with incident response, breach readiness, or security/privacy escalation processes. - Strong project and program management skills and excellent written communication. Bonus points for: - Experience supporting ISO 27001 readiness, SOC 2 readiness, audits, or certifications. - Experience working in an open-source, consumer software, or mission-driven technology organization. - Privacy certification such as CIPP/E, CIPP/US, CIPM, or similar.