Privacy and Compliance Specialist

Virta Health is on a mission to reverse metabolic disease in one billion people. Current treatment approaches aren’t working—over half of US adults have either type 2 diabetes or prediabetes, and obesity rates are at an all-time high. Virta is changing this by helping people reverse their metabolic condition through innovations in technology, personalized nutrition, and virtual care delivery reinvented from the ground up. We have raised over $350 million from top-tier investors, and partner with the largest health plans, employers, and government organizations to help their employees and members restore their health and take back their lives. Join us on our mission to reverse metabolic disease in one billion people. Virta's Legal team seeks a Privacy & Compliance Specialist to own the day-to-day execution of privacy operations, manage cross-functional compliance projects and serve as a primary point of contact for privacy-related customer and partner inquiries. This individual will work closely with Legal, Engineering, Product, Security, and Commercial teams to maintain and strengthen Virta's privacy posture as the company scales. The role is high-impact and high-autonomy, designed for a subject matter expert who thrives at the intersection of privacy law, project management, and health tech operations.

Responsibilities The Privacy & Compliance Specialist will be responsible for the following areas of work: Privacy Program Operations

• With supervision from the Sr. Corporate Counsel and Privacy Officer, manage and maintain Virta’s privacy compliance program, including policies, procedures, and documentation.

• Conduct and coordinate privacy impact assessments (PIAs/DPIAs) and data protection assessments for new products, features, and vendor relationships.

• Maintain records of processing activities (RoPA), data inventories, and data flow maps.

• Monitor and operationalize requirements under HIPAA, state privacy laws (CCPA/CPRA and other state comprehensive privacy laws), and other applicable frameworks.

• Implement and support Privacy by Design across all aspects of Virta’s business.

• Support data subject rights requests (DSARs) and privacy incident response workflows.

Customer and Partner Privacy Support

• Serve as a primary point of contact for privacy and data-related inquiries from customers, prospects, and partners.

• Draft and maintain responses to privacy questionnaires, RFPs, security assessments, and due diligence requests.

• Support the negotiation and review of Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs).

Project Management and Cross-Functional Coordination

• Drive privacy and compliance initiatives from planning through execution, managing timelines, stakeholders, and deliverables.

• Develop and deliver privacy training and awareness programs across the organization, fostering a culture of respect for protected health information and other categories of protected data.

• Build and maintain privacy metrics, dashboards, and reporting for leadership and Board visibility.

• Identify opportunities to improve and automate privacy processes and workflows.

90 Day Plan Within your first 90 days at Virta, we expect you will do the following:

• Get up to speed on Virta’s privacy program, existing policies, data flows, and key stakeholders across Legal, Engineering, Product, Security, and Commercial teams

• Take ownership of the privacy impact assessment process and complete at least one PIA/DPIA for a current initiative

• Assume management of incoming privacy questionnaires, RFPs, and customer/partner privacy inquiries, establishing repeatable response workflows

• Review existing DSAR and privacy incident response workflows and identify concrete improvement opportunities

• Begin building privacy metrics and reporting to provide leadership with visibility into program performance and risk posture

Must-Haves

• 4 to 7 years of experience in privacy, compliance, data protection, or a related field

• Working knowledge of HIPAA, state consumer privacy laws (including CCPA/CPRA), and health data regulations

• Demonstrated project management skills with the ability to manage multiple workstreams simultaneously

• Experience with privacy impact assessments, incident response, or data subject request (DSAR) workflows

• Strong written and verbal communication skills, with the ability to translate complex privacy requirements into practical guidance

• Demonstrates a proactive use of AI tools to improve individual output and efficiency

Values-driven culture Virta’s company values drive our culture, so you’ll do well if:

• You put people first and take care of yourself, your peers, and our patients equally

• You have a strong sense of ownership and take initiative while empowering others to do the same

• You prioritize positive impact over busy work

• You have no ego and understand that everyone has something to bring to the table regardless of experience

• You appreciate transparency and promote trust and empowerment through open access of information

• You are evidence-based and prioritize data and science over seniority or dogma

• You take risks and rapidly iterate

Is this role not quite what you're looking for? Join our Talent Community and follow us on Linkedin to stay connected! Virta has a location based compensation structure. Starting pay will be based on a number of factors and commensurate with qualifications & experience. For this role, the compensation range is $100,000 to $120,000. Information about Virta’s benefits is on our Careers page at: https://www.virtahealth.com/careers.

As part of your duties at Virta, you may come in contact with sensitive patient information that is governed by HIPAA. Throughout your career at Virta, you will be expected to follow Virta's security and privacy procedures to ensure our patients' information remains strictly confidential. Security and privacy training will be provided. As a remote-first company, our team is spread across various locations with office hubs in Denver and San Francisco. Clinical roles: We currently do not hire in the following states: AK, HI, RI Corporate roles: We currently do not hire in the following states: AK, AR, DE, HI, ME, MS, NM, OK, SD, VT, WI. Virta uses Ashby as its applicant tracking system, which incorporates AI-powered tools (provided by OpenAI, AWS, and Google Gemini) in certain aspects of the recruiting process, including application review, candidate screening, and interview note taking; your data is not used to train AI models, and all final hiring decisions are made by Virta Health personnel. For more information, see Ashby's AI Terms at https://www.ashbyhq.com/resources/terms-ai-features #LI-remote