Privacy Analyst, Legal

Our mission: to eliminate every barrier to mental health. 

Spring Health is a comprehensive mental health solution for employers and health plans. Unlike any other solution, we use clinically validated technology called Precision Mental Healthcare to pinpoint and deliver exactly what will work for each person  — whether that’s meditation, coaching, therapy, medication, and beyond. 

Today, Spring Health equips over 800 companies, from start-ups to multinational Fortune 500 corporations, as a leading and preferred mental health service. Companies like J.P. Morgan Chase & Co., Microsoft, J.B. Hunt, Bumble, and Instacart use the Spring Health platform to provide mental health services to thousands of their team members globally. We have raised over $370 million from prominent investors including Kinnevik, Tiger Global, Northzone, RRE Ventures, and many more. Thanks to their partnership, our current valuation has reached $2.5 billion.

We’re looking for a Privacy Analyst to join our highly collaborative team who is responsible for supporting the development, implementation, and oversight of the organization’s Privacy program. The Privacy Analyst will report to the Associate General Counsel (AGC) for Privacy, Security, and Data Protection. The successful candidate will be able to adapt to rapidly changing priorities and business needs, and must be proactive in identifying and addressing privacy matters across the organization. 

What you’ll be doing:

• Work with the AGC for Privacy, Security and Data Protection to administer the privacy program and related processes for documenting, investigating, and implementing corrective actions related to privacy incidents 
• Support implementation of privacy policies, risk assessments, quality assurance, and oversight activities related to privacy matters
• Review and investigate alleged unauthorized access, use and/or disclosures of personal information; ensure appropriate remediation is completed
• Provide guidance to business teams regarding applicable data protection requirements
• Collaborate with various stakeholders in managing and mitigating privacy incidents and risks including the privacy team, affected parties, business teams, or government agencies
• Help develop annual and ongoing trainings and awareness campaigns
• Manage DSRs (data subject requests) to access, modify, or delete personal information or related member requests 
• Actively partner with security and compliance teams on review of applicable systems and applications, new products, or planned data structure changes
• Support RFPs and customer inquiries or surveys related to privacy or data protection
• Other duties as assigned

What we expect from you: 

• Bachelor’s degree from four-year college; data privacy certification (e.g. CIPP, CIPM, etc.) preferred 
• 3+ years of privacy experience, preferably within the healthcare industry and part of either an in-house legal or compliance team 
• Knowledge of US federal and state privacy laws and understanding of worldwide data protection regulations, including HIPAA, CCPA, GDPR, etc. 
• Experience with high-growth enterprise SaaS company or related experience preferred
• Ability to independently research, analyze, organize, and clearly summarize privacy issues for lawyers and non-lawyers alike
• Exceptionally strong business acumen and the ability to work effectively on multiple projects in a busy work environment while serving as critical (and often autonomous) go-to partner across the company and legal department
• Strong sense of ownership and accountability over assigned projects and task
• High level of integrity, professionalism, intellectual curiosity, and willingness to grow
• Participate as a team player in all phases of the organization; remain open and responsive to change
• Maintain strict confidentiality of personnel data, proprietary information, and sensitive materials as required

The target salary range for this position is $109,500 - $135,250, and is part of a competitive total rewards package including stock options, benefits, and incentive pay for eligible roles. Individual pay may vary from the target range and is determined by a number of factors including experience, location, internal pay equity, and other relevant business considerations. We review all employee pay and compensation programs annually at minimum to ensure competitive and fair pay.

Don’t meet every requirement? Studies have shown that women, communities of color and historically underrepresented talent are less likely to apply to jobs unless they meet every single qualification. At Spring Health we are dedicated t