Associate Compliance Privacy Director @ Exelixis

SUMMARY/JOB PURPOSE

The Associate Compliance Privacy Director will support and advance Exelixis' privacy compliance program as a privacy subject matter expert and point of contact. This role partners with cross-functional teams to ensure enterprise-wide compliance with U.S. and global privacy and data security requirements, including the EU General Data Protection Regulation (GDPR), clinical trial regulations, and HIPAA obligations for the employee group health plan. The Associate Compliance Privacy Director is responsible for supporting policy and SOP development, training, assessments, audits, monitoring, and coordination with Legal Affairs to translate evolving requirements into scalable, practical solutions that promote privacy and data security by design.

ESSENTIAL DUTIES/RESPONSIBILITIES

• Provide strategic and operational privacy support across the company, and as designated Compliance representative on Information Governance Council and privacy control for relevant business processes, including incident response and management, information and data governance, and data security.
• Develop a deep understanding of how data is used across Exelixis’ products, teams and research; document, and implement privacy requirements for new products and initiatives.
• Develop, document, and maintain privacy operations processes and procedures. Assist with the development and maintenance of privacy training and awareness programs for functions, new hires, and key stakeholders to foster a culture of privacy compliance and data security across the organization.
• In collaboration with, and at the direction of Legal Affairs, conduct and complete internal investigations of privacy matters, including providing support on any corrective action.
• Monitor and assess the impact of evolving U.S. federal and state privacy and data security laws, regulatory guidance, and enforcement trends on Exelixis’ business operations and privacy compliance program.
• Develop the report on privacy compliance program key performance indicators and metrics to senior leadership, ensuring visibility and alignment on program maturity and risk posture as well as driving continuous improvement.
• Partner with global clinical trial operations in implementing data protection requirements, including data transfer mechanisms, personal data notices, consent language, and data processing controls.
• In collaboration with Legal Affairs, provide guidance on HIPAA compliance requirements for the company’s group health plan, coordinating efforts with HR and benefits administrators.
• Conduct and manage privacy and data impact assessments, as needed.
• Support cross-border data transfer compliance, including documenting transfer impact assessments and other requirements under SCCs, UK IDTA, and other mechanisms.
• Manage data subject rights requests, coordinate data review and responses across relevant functions and maintain compliance documentation.
• Collaborate with Legal Affairs and Information Technology (IT) on incident response and breach notification processes.
• Align with Legal Affairs on preferred privacy-related and data security-related contract terms and provisions. Partner with IT to operationalize data protection requirements into business processes, policies, and administrative and technical controls in a variety of functions in the enterprise.
• Analyze privacy impact of, and recommend appropriate controls for, initiatives leveraging Artificial Intelligence (AI), biometrics, and emerging technologies.
• Manage data processing activities and respond to data subject and regulator’s inquiries. Knowledge of and ability to incorporate Privacy by Design (PbD) principles into work products, processes, and decision-making to ensure privacy, data protection, and risk mitigation are considered from the outset and throughout the lifecycle of initiatives.
• Define, scope, and execute technical frameworks for website tracking privacy to align marketing technologies (MarTech) with global privacy regulations through robust consent management architecture, rigorous tag governance, and continuous compliance auditing.
• Build strong, collaborative relationships with key stakeholders across the organization to ensure alignment on vision, priorities, and outcomes of business initiatives and projects.
• Participate in working groups, governance committees, and cross-functional initiatives that have a privacy and data security impact.
• Performs other duties as assigned
• Complies with all policies and standards

SUPERVISORY RESPONSIBILITIES

• No supervisory responsibilities.

EDUCATION/EXPERIENCE/KNOWLEDGE/SKILLS & ABILITIES

Education

• Bachelor’s degree in related discipline and 11 years of relevant experience; or
• Equivalent combination of education and years of experience.
• CIPP/US, CIPP/E, CIPM or similar certification preferred.

Experience

• Minimum of 11 years professional experience, including 9 in privacy or data protection in a life sciences, biotech, pharma, or medical device industry required, with a focus on program operations and governance, risk, and compliance activities.
• Minimum of 2 years project management experience in a matrixed organization.
• Experience advising on privacy matters related to health information processing and familiarity with patient consent management, call center operations, and digital outreach.
• Experience working across a matrixed corporate environment.
• Experience with AI and data governance is preferred.
• Experience with HIPAA compliance in an employee benefits context a plus
• Experience with privacy/knowledge management platforms and tools (e.g., OneTrust, SNOW, Confluence) is preferred.
• Experience with privacy matters in the digital and advertising technology ecosystem in the biopharmaceutical industry a plus.

Knowledge, Skills and Abilities

Required

• Excellent interpersonal communication, collaboration, project management, and stakeholder management skills, with the ability to influence and collaborate effectively at all levels of the organization.
• Ablility to develop and deliver clear and concise presentations, to influence and collaborate effectively at all levels of the organization.
• Ability to think strategically with a proactive, risk-based approach
• Ability to exercise sound ethical judgment and consistently uphold data protection principles.
• Ability to devise creative business solutions for complex problems and implement organizational or team objectives.
• Effectively manages ambiguity, handling multiple tasks simultaneously and adjusting priorities quickly.
• Highly organized, detail-oriented, and analytically rigorous, with ability to effectively multi-task and prioritize matters.
• Must be a self-starter and quick learner.
• Requires strong computer skills (e.g., Microsoft Office Suite (Word, Excel, PowerPoint, etc.) document comparison programs, and Internet).

Preferred

• Strong understanding of global privacy frameworks and regulatory trends.
• Proven ability to operationalize legal requirements into practical business solutions.
• Familiarity with privacy considerations in vendor management, data transfers, and research protocols.
• Demonstrated success implementing privacy compliance measures in a matrixed organization.

Travel Requirements

• 20% This position requires up to 20% travel

#LI-HG1

Location: Alameda, CA

Range for this position: $219,000 - $278,000

The base pay offered will take into account job-related knowledge, skills, experience and internal equity, among other factors.

In addition to the base salary, as part of our Total Rewards program, Exelixis offers comprehensive employee benefits package, including a 401k plan with generous company contributions, group medical, dental and vision coverage, life and disability insurance, and flexible spending accounts. Employees are also eligible for a discretionary annual bonus program, or if field sales staff, a sales-based incentive plan. Exelixis also offers employees the opportunity to purchase company stock, and receive long-term incentives, 15 accrued vacation days in their first year, 17 paid holidays including a company-wide winter shutdown in December, and up to 10 sick days throughout the calendar year.

Exelixis is an Equal Opportunity Employer. We are committed to fostering an inclusive environment where everyone can thrive. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy (including lactation, childbirth, or related medical conditions), sexual orientation, gender identity, age (40 and over), national origin or ancestry, citizenship or immigration status, physical or mental disability, genetic information (including testing and characteristics), veteran status, uniformed servicemember status, or any other characteristic protected by applicable federal, state, or local law. We are also committed to providing reasonable accommodations to qualified individuals with disabilities, unless undue hardship and/or a direct threat to the health and/or safety of the individual or others would result.

If you have a disability and need an accommodation in relation to the recruiting process, please email us at: [email protected].

Exelixis is an E-Verify employer.

WORKING CONDITIONS

Our office is a modern space that fosters collaboration and creativity. Teams work closely together, sharing ideas and solutions in a supportive atmosphere. We provide all necessary equipment, including dual monitors and ergonomic chairs, to ensure a comfortable workspace.

DISCLAIMER

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to the job.