Privacy Operations Lead

Company Overview Deepgram is the leading platform underpinning the emerging trillion-dollar Voice AI economy, providing real-time APIs for speech-to-text (STT), text-to-speech (TTS), and building production-grade voice agents at scale. More than 200,000 developers and 1,300+ organizations build voice offerings that are ‘Powered by Deepgram’, including Twilio, Cloudflare, Sierra, Decagon, Vapi, Daily, Cresta, Granola, and Jack in the Box. Deepgram’s voice-native foundation models are accessed through cloud APIs or as self-hosted and on-premises software, with unmatched accuracy, low latency, and cost efficiency. Backed by a recent Series C led by leading global investors and strategic partners, Deepgram has processed over 50,000 years of audio and transcribed more than 1 trillion words. There is no organization in the world that understands voice better than Deepgram. Company Operating Rhythm At Deepgram, we expect an AI-first mindset—AI use and comfort aren’t optional, they’re core to how we operate, innovate, and measure performance. Every team member who works at Deepgram is expected to actively use and experiment with advanced AI tools, and even build your own into your everyday work. We measure how effectively AI is applied to deliver results, and consistent, creative use of the latest AI capabilities is key to success here. Candidates should be comfortable adopting new models and modes quickly, integrating AI into their workflows, and continuously pushing the boundaries of what these technologies can do. Additionally, we move at the pace of AI. Change is rapid, and you can expect your day-to-day work to evolve just as quickly. This may not be the right role if you’re not excited to experiment, adapt, think on your feet, and learn constantly, or if you’re seeking something highly prescriptive with a traditional 9-to-5. The Opportunity Deepgram is looking for a Privacy Operations Lead to own the operational backbone of our privacy program. Deepgram processes audio — often some of the most sensitive data our customers hold — across several deployment models: hosted with model-improvement opted in, hosted with model-improvement opted out (effectively zero data retention), single-tenant Deepgram Dedicated deployments with regional data residency, and fully self-hosted deployments running in the customer's own environment. Our hosted services run primarily on our own bare-metal infrastructure in colocation datacenters, with AWS used for overflow capacity and a small set of services — so knowing where data actually lives means knowing our datacenters, not just a cloud console. You will be the person who knows, in operational detail, how data moves through each of those models — and who turns that knowledge into durable artifacts: data flow maps, records of processing, assessment templates, playbooks, and self-service guidance that Legal, Engineering, and Sales Engineering can use without re-deriving the answer every time. You will also be the technical voice in enterprise customer privacy reviews. This is not a policy-writing job. Roughly half the work is assessment and advisory; the other half is designing and operating the processes and tooling that make our privacy claims repeatable and verifiable. Where verification requires reading code or inspecting infrastructure, you will define what needs to be proven and partner with Security and Engineering to prove it — you are not expected to do that engineering work yourself. This role reports to the Director of Information Security and works closely with Legal, Engineering, and Solutions/Sales Engineering. We are open on level. This is a senior individual-contributor role, and we will calibrate title, scope, and compensation to demonstrated experience. About Deepgram Deepgram builds foundational voice AI — speech-to-text, text-to-speech, and voice agent infrastructure — used by enterprises and developers to build production voice applications at scale. Our models are trained and served on our own infrastructure, and we offer hosted, dedicated single-tenant, and self-hosted deployment options so customers can meet their own data residency and retention requirements. Learn more at deepgram.com . Responsibilities Own customer and prospect privacy risk assessments, DPIAs, and transfer impact assessments end to end. Be the technical voice in customer privacy reviews and vendor due diligence calls. Build and maintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments — including which datacenter, region, or cloud each flow touches — and own the process that keeps them accurate as the product changes. Translate GDPR, UK GDPR, CCPA/CPRA and other US state privacy laws, and emerging AI regulation (EU AI Act, state AI and automated decision-making rules) into concrete requirements that engineering and GTM teams can act on, rather than memos. Define the privacy requirements for product and infrastructure changes — retention, logging and telemetry, third-party subprocessors, training-data lineage — and drive them to implementation with the owning teams. Own the operating model for our privacy controls: retention and deletion enforcement, DSAR and deletion workflows, consent and opt-out handling, de-identification and redaction. You specify, instrument, test, and audit; Engineering builds. Design and run operational auditing and remediation workflows, so drift between what we claim and what we do is caught by process rather than by a customer. Own the subprocessor and vendor privacy review process — including colocation and infrastructure providers — and the artifacts that support our DPAs and trust center. Own privacy enablement: playbooks, self-service guidance, and training for Engineering, Support, and Sales Engineering — including what Sales Engineering is and is not allowed to promise. Partner with Legal on DPAs, SCCs, transfer mechanisms, and the resi