Technical Privacy Consultant (Part-Time, 50%)

Location: 100% remote work (Poland) Workload: Part-time / 0.5 FTE Working hours: 50% allocation (approx. 4 hours/day) within standard German business hours (09:00-18:00 CET), with a fixed daily schedule and occasional flexibility for ad-hoc project needs Duration: 6-12 months Availability: ASAP / within 1 month

About the Role

We are seeking a highly autonomous Technical Privacy Consultant (Individual Contributor) to support the Product Data Governance team on a short-term loan staff basis. This role focuses entirely on the technical evaluation and operational review of Privacy-by-Design and Privacy-by-Default principles across the product landscape.

The team acts as a consulting partner to product teams, including Product Owners, Data Architects, and System Architects. This position does not involve hands-on software development, coding, or infrastructure implementation. However, a deep practical understanding of technical privacy controls and their implementation is required to effectively assess architectures and guide developers and architects.

The successful candidate will be a self-starter who can operate with minimal supervision and take full ownership of technical privacy evaluations.

Responsibilities

• Review and critically assess system architectures, digital products, and data processing workflows across all stages of the product lifecycle to ensure alignment with Privacy-by-Design and Privacy-by-Default principles
• Partner with Product Owners and Architects to translate complex regulatory requirements into technical design concepts, system requirements, and architectural acceptance criteria for engineering teams
• Execute or support Privacy-by-Design assessments and Data Privacy Impact Assessments (DPIA) from a technical perspective
• Identify system-level privacy and security risks, evaluate architectural weaknesses, and recommend mitigating and compensating controls
• Advise engineering teams on technical privacy solutions, including encryption methods, pseudonymization schemas, data minimization, access governance, and secure transfer protocol design
• Assess architectures to verify compliance with technical requirements related to GDPR, HIPAA, EU Data Act, and EU AI Act
• Act as a technical bridge between Engineering, Legal, Security, Quality, and business functions
• Communicate complex technical privacy risks and negotiate solutions with a wide range of stakeholders

Requirements

Mindset & Autonomy

• Proven ability to learn quickly, understand complex technical ecosystems, and take ownership of assessments with minimal supervision
• Strong organizational skills and the ability to deliver structured architectural feedback in evolving or loosely defined product environments
• Excellent communication and negotiation skills
• Ability to explain complex technical privacy risks to non-technical stakeholders
• Confidence in challenging senior developers on architectural decisions when required

Technical Knowledge

• 5+ years of experience as a Privacy Architect, Privacy-by-Design Consultant, Technical Privacy Auditor, or in a similar role
• Strong knowledge of GDPR technical implementation, including data minimization, purpose limitation, and security of processing
• Deep understanding of architectures and tools supporting Data Subject Rights (DSR), consent management, and auditability
• Solid understanding of infrastructure segregation, API Gateway hardening, private network tunneling, and browser session hardening
• Practical knowledge of cryptographic segregation, Application-Level Encryption (ALE), secure tokenization, and data lake and analytics protection techniques such as PETs, k-anonymity, and Differential Privacy
• Familiarity with compliance standards such as ISO/IEC 27001 and SOC2 and their integration into technical risk assessments

Certifications

The following certifications are highly valued

• CIPT
• CDPSE
• CISSP
• CIPP/E
• CIPM
• CDPO
• Other equivalent technical privacy or security certifications

What This Role Is Not

• Not a hands-on software engineering role
• Not a DevSecOps implementation role
• Not a code-writing position
• Not a legal policy-writing role
• Focused on technical privacy architecture reviews, identification of privacy gaps, and consulting on mitigation approaches

Language Requirements

• Fluent English
• German is considered a strong asset but is not required

What We Offer

• Multisport card
• Private healthcare
• Group life insurance