Reset your expectations of a health and wellness agency. From our inception, Fingerpaint has been driven by an unstoppable collective spirit of possibility. It’s that curiosity that’s at the heart of everything we do. From our legendary people-first culture to the hundreds of Fingerpainters who define us, we’ve reimagined what it means to be a healthcare and wellness advertising agency. Here, creativity happens naturally—we attract top talent and collaborate.
This is not a traditional data governance role. No catalog build-out, no lineage tooling, no data quality work. You will own our data governance assessment service — the on-demand review teams rely on when they need to know whether and how they can use data — and evolve it from a high-touch service into a ticketed, tiered and largely automated process with clear SLAs.
The job sits at the intersection of data, technology, AI, privacy, contracts and agency media operations. Our internal counsel owns legal interpretation of contracts, DPAs and DUAs. Your job is to package those reviews so they start half-complete, take the answers counsel gives, and turn them into practical processes, controls and guidance that media, account, engagement and strategy teams can actually use — and to automate as much of that work as can be automated. That is why the role reports to the VP of Platform Engineering rather than into Legal. The mandate is operational and technical: build the workflow, the controls and the tooling, with counsel as the authority on what the contracts mean. This is an individual contributor role with no direct reports.
What you'll do
Run the assessment service
Own the data governance assessment end to end — intake, risk-based tiering, review, decision and approval — with clear request types, published SLAs and a documented path teams can follow.
Close every assessment with defined commitments: what data, for what use, with what handling requirements (access, security, transfer, retention, deletion), who implements each, and how we verify it.
Prepare structured briefs for counsel so legal review starts half-complete, and coordinate them through to execution.
Cascade obligations into working guidance
Translate the requirements counsel identifies in client contracts, statements of work (SOWs), data processing agreements (DPAs), data use agreements (DUAs) and vendor agreements into concrete restrictions, controls and workflows — and identify which teams, systems and data flows are affected.
Build playbooks, decision trees and self-service tools that help teams find a compliant path to what they are trying to accomplish, rather than a reason they cannot.
Run training and enablement and turn recurring questions into better process, so teams need to ask less over time.
Automate what can be automated
Treat recurring compliance work — repeated reviews, manual evidence collection — as a candidate for automation rather than a permanent cost.
Partner with Product, Data Platform and Engineering to define requirements for automated data-use approval and access workflows, retention and deletion controls, client-specific restrictions, compliance alerting and automated evidence capture.
Inform governance requirements for our customer graphs and audience assets alongside Analytics, Media and Data Platform.
Evaluate AI-assisted approaches — assessment triage, requirement extraction, drafting guidance, generating control evidence — and judge whether the output is reliable enough to depend on.
Measure and report
Maintain practical reporting on open issues, exceptions and remediation, control completion, assessment volume and cycle time, and obligations approaching expiry — so leadership can see what needs attention and where to invest.
What we're looking for
A subject matter expert with an operator's mindset. Experienced enough to work independently, and genuinely interested in privacy, compliance and data governance as a practice.
Fluency in data flows and data modeling. Comfortable with schemas, row-level versus aggregate data, identifiable versus de-identified data, pipelines, APIs, warehouses, access controls, sharing, retention and deletion. Basic SQL is strongly preferred.
Proportionate judgment. You can tell the difference between what needs counsel, what needs a formal assessment, what an existing control already covers, and what just needs a practical answer over Slack.
Able to influence without authority. You build trust across teams, explain complex issues clearly, and hold people to commitments without creating friction.
Experience and qualifications
Required
6+ years in data governance, privacy operations, data management, stewardship, compliance or data risk.
Demonstrated experience translating contractual, regulatory, or policy requirements into operating processes and technology.
Experience working with data contracts and data-use restrictions.
Working knowledge of HIPAA, CCPA/CPRA and US state privacy laws, including the state health privacy statutes now driving most of the risk in pharma media — Washington's My Health My Data Act, Nevada SB 370 and Connecticut's health data amendments.
Familiarity with HIPAA de-identification standards (Safe Harbor and Expert Determination) as they apply to audience assets and customer graphs.
Preferred
Experience defining requirements alongside Product, Engineering or Data Platform teams, and automating compliance or governance workflows.
Familiarity with AI governance and responsible data use.
Working knowledge of the media lifecycle from activation to measurement; exposure to ad tech and programmatic media.
Healthcare, life sciences or pharmaceutical marketing background, with agency, consulting or client-services experience.
CIPP/US, CIPM or equivalent certification.
Why this role
You inherit an established strategy and process framework. Your job is the next chapter: good judgment first, then clear process, operational controls, technology and scale.
Most governance roles end at writing the policy. This one is funded to build past it — you sit inside Platform Engineering, with engineers to define requirements against and a mandate to automate the work rather than staff it. Come build the program you've had to work around everywhere else.
Don’t meet every single requirement? That’s okay! Studies have shown that women and people of color are less likely to apply to jobs unless they meet every single qualification. At Fingerpaint, we are dedicated to building a diverse, inclusive, and authentic workplace, so if you’re excited about this role but your experience doesn’t align perfectly, we encourage you to apply anyway. You may be just the right candidate for this or other roles! Our team of qualified recruiters can match you with the right opportunity. Fingerpaint Group provides equal employment [and affirmative action] opportunities to all applicants and employees. We are proud to recruit qualified applicants without regard to race, color, religion, gender, age, ethnic or national origin, protected veteran status, physical or mental disability, sexual orientation, gender identity, marital status, or citizenship status.
6+ years in data governance, privacy operations, or compliance; experience translating contractual/regulatory requirements into processes; knowledge of HIPAA, CCPA/CPRA, and state health privacy laws; familiarity with HIPAA de-identification standards.
Key Responsibilities
- managing data governance
- automating compliance workflows
- building operational controls
Skills & Tools
SQL, Slack
Job Details
- Category: Data and Analytics
- Seniority: Senior Level
- Commitment: Full Time
- Workplace: Remote — United States
- Languages: English
About Fingerpaint Group
A health and wellness advertising agency with a people-first culture and creative collaboration. — Industry: Media and Communications