About this role
WELLTOWER – REIMAGINE REAL ESTATE WITH US
At Welltower, we're transforming how the world thinks about senior living and wellness-focused real estate. As a global leader in residential wellness and healthcare infrastructure, we create vibrant, purpose-driven communities where housing, healthcare, and hospitality converge. Our culture is fast-paced, collaborative, and endlessly ambitious—guided by our mantra: The only easy day was yesterday.
We're looking for bold, independent thinkers who thrive on challenge, embrace complexity, and are driven to deliver long-term value. Every team member is empowered to think like an owner, innovate fearlessly, and lead from where they stand. If you're passionate about outcomes and inspired by the opportunity to shape the future of healthcare infrastructure, we want you on our best-in-class team.
ABOUT THE ROLE
Welltower is looking for a Privacy Engineer to help build and scale the technical side of our privacy program. This role will work at the intersection of legal, security, and technology, turning privacy requirements into practical, working controls that protect our data and help the business move faster.
This role will design and build the technical solutions, in specified platforms, of privacy compliance to reflect the policies, positions and initiatives we are taking. This role will bridge the gap between legal requirements and technical implementation and will build the tools, tests, and controls that put them into practice. This is a hands-on role with high visibility and a real opportunity to shape a growing program.
KEY RESPONSIBILITIES
• Privacy risk assessments: Integrate privacy reviews, including privacy impact assessments (PIAs) and privacy threat modeling, into the existing security intake process so that privacy risks are identified early, both for new vendors and for facilities before they are onboarded without duplicating assessments or slowing the business down.
• Incident response: Work alongside the security team during incidents, assessing privacy impact in parallel with the technical investigation. Analyze impacted PHI and PII to support fast decision-making and regulatory notification analysis.
• Privacy by design: Get involved early in the planning of new systems, products, and initiatives. Working with business and technology teams, this role will identify privacy risks and implement privacy-by-design patterns and data minimization controls such as collecting only the data that's needed, limiting who can access it, setting retention rules, and capturing consent where required, so privacy is built in from day one rather than added later.
• Regulatory translation: Interpret what privacy laws such as UK GDPR, HIPAA, CCPA, and other U.S. state privacy laws require in practice, and turn those requirements into specific technical controls and system settings. Examples include access restrictions, data retention and deletion rules, consent capture, and automated checks that confirm we stay compliant over time.
• Data governance: Lead and maintain critical initiatives such as data inventories, data mapping, data classification (including distinguishing PHI from PII), and our OneTrust implementation, keeping them current as the business evolves.
• Web consent and marketing privacy controls: Configure and maintain privacy controls across Welltower's websites and marketing technology. This includes consent and cookie management in OneTrust, tag and pixel governance, honoring browser opt-out signals such as Global Privacy Control, and making sure consent preferences carry through to analytics, CRM and advertising platforms. Run regular scans and testing to confirm these controls keep working as sites and vendors change, especially on pages where tracking could expose health or other sensitive information.
• Privacy operations: Handle the day-to-day technical work that keeps our privacy program running, including: reviewing vendors' privacy and data handling practices as part of procurement; monitoring consent preferences and website cookies; tagging and classifying data (for example, identifying PHI versus PII); analyzing the data involved in potential breaches; and building out role-based access controls (RBAC) so employees can access only the data they need for their roles.
• Privacy automation and technical controls: Build and automate the technical side of the privacy program using Python or similar program languages. That means connecting data subject request workflows to the systems where data lives, running automated data discovery and classification, and working with Data Engineering and Security to put in place safeguards such as masking, encryption, and retention and deletion jobs. Manage code and configuration in GitHub, build privacy check into CI/CD pipelines, and use Infrastructure as Code (IaC) to apply privacy controls consistently across environments. Write repeatable tests and scripts that confirm privacy requirements are still being met after system changes and releases.
OTHER DUTIES
Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities that are required of this employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.
TRAVEL
This role may involve occasional out-of-area and overnight travel.
MINIMUM REQUIREMENTS
• Bachelor's degree in a related field is required. Master's degree is preferred.
• 3+ years of experience in privacy engineering, privacy operations, information security, or a related technical compliance role.
• Working knowledge of HIPAA, UK GDPR, CCPA/CPRA and other U.S. state privacy laws, including the technical requirements behind them (opt-out preference signals, sensitive data consent and tracking technology guidance)
• Familiarity with data mapping, data classification, access controls, and vendor risk assessment.
• Experience automating solutions using Python or similar programming and scripting languages.
• Experience with GitHub, CI/CD pipelines, and Infrastructure as Code (e.g., Terraform, CloudFormation).
• Familiarity with SQL, data warehousing (Snowflake preferred), and AWS or other cloud platforms.
• Experience conducting privacy threat modeling (e.g., LINDDUN) and privacy impact assessments.
• Experience implementing privacy-by-design patterns and data minimization controls.
• Proven ability to partner with technical teams to translate privacy requirements into clear technical specifications.
• Hands-on experience configuring a consent management platform (OneTrust strongly preferred), including cookie categorization, geo-rules and script blocking.
• Understanding of marketing and analytics technology (e.g., GA4, Meta Pixel, Conversions API, server-side tagging) and the privacy risks each one carries.
• Ability to explain technical and regulatory concepts clearly to legal, security, and business audiences.
• Privacy certification such as CIPT, CIPP/US, or CIPP/E is a plus.
Employment is contingent upon the successful completion of a background check, drug screening, and verification of employment, education, and other credentials relevant to the position.
WHAT WE OFFER
• Competitive Base Salary + Annual Bonus
• Generous Paid Time Off and Holidays
• Employee Stock Purchase Program – purchase shares at a 15% discount
• Employer-matching 401(k) Program + Profit Sharing Program
• Student Debt Program – we'll contribute up to $10,000 towards your student loans!
• Tuition Assistance Program
• Comprehensive and progressive Medical/Dental/Vision options
• Professional Growth
• And much more! https://welltower.com/newsroom/careers/
ABOUT WELLTOWER
Welltower® Inc. (NYSE: WELL) an S&P 500 company, is the world's preeminent residential wellness and healthcare infrastructure company. Our portfolio of 1,500+ Seniors and Wellness Housing communities is positioned at the intersection of housing, healthcare, and hospitality, creating vibrant communities for mature renters and older adults in the United States, United Kingdom, and Canada. We also seek to support physicians in our Outpatient Medical buildings with the critical infrastructure needed to deliver quality care.
Our real estate portfolio is unmatched, located in highly attractive micro-markets with stunning built environments. Yet, we are an unusual real estate organization as we view ourselves as a product company in a real estate wrapper driven by relationships and unconventional culture.
Through our disciplined approach to capital allocation powered by our data science platform and superior operating results driven by the Welltower Business System, we aspire to deliver long-term compounding of per share growth and returns for our existing investors – our North Star.
Welltower is committed to leveraging the talent of a diverse workforce to create great opportunities for our business and our people. EOE/AA. Minority/Female/Sexual Orientation/Gender Identity/Disability/Vet