Privacy Manager

About the Role

This is where you come in. Below, you’ll find what this role is all about: the impact you’ll drive, the challenges you’ll tackle, and what it takes to thrive at Addi. If you’re ready to be part of something big, keep reading.

What’s the mission you’ll drive

Drive Addi’s privacy and AI governance, as Data Protection Officer and trusted partner to the General Counsel and Head of Legal, to keep Addi compliant with Colombian regulation and in good standing with the SIC and SFC, ensuring the business can use data and AI lawfully, quickly, and with confidence.

What you will do

• Lead Addi’s privacy program across all of its entities. This includes assessing compliance against applicable regulations, defining priorities, and driving remediation.

• Maintain a clear view of how personal data flows through the company, including legal bases, counterparties, and regulatory registrations. Keep it current as new products, entities, and funding structures appear.

• Work with the Data and Cybersecurity teams to add a privacy layer to Addi’s data governance, covering data classification, legal basis for each use, retention, and data minimization.

• Prepare and advise on incident response, including legal risk assessment, stakeholder coordination, and regulatory reporting.

• Join product, alliance, and vendor discussions from the start. Review launches that touch personal data before go-live, in a way that helps the business move forward and doesn’t slow it down.

• Negotiate and review data processing agreements and cross-border transfer terms with cloud and technology vendors.

• Design and run an AI governance framework for both product AI (credit models, automated decisions, customer-facing agents) and internal AI tools. This covers use-case inventory, risk-based review, proportional approval paths, and rules for AI vendors.

• Use AI tools to make legal and privacy work faster, for example to handle routine consultations and contract reviews, so you can focus on complex judgment calls.

• Manage external advisors when you need extra or specialized capacity.

• Represent Addi on privacy and AI matters before regulators, and take part in industry working groups and public consultations, including through Colombia Fintech.

   

What we’re looking for

Proven experience in Colombian data protection law and regulatory practice

• Licensed lawyer with 10+ years of total legal/compliance experience, including at least 6 years specifically in data protection/privacy.

• Direct experience interacting with the SIC (Superintendencia de Industria y Comercio) — filings, inquiries. Having worked at the SIC is a strong plus.

• Nice to have: exposure to international frameworks (e.g., GDPR, Brazil's LGPD), given Addi's entities abroad and potential international expansion.

Track record of running privacy programs as a solo or near-solo function

• Has operated as the sole or near-sole owner of a privacy function, not just as part of a large team.

• Prior experience as a DPO, privacy counsel, or senior privacy/compliance lead, ideally in a regulated, high-growth environment (fintech, financial services, or consumer tech) OR prior experience working at the SIC. Both is ideal, but one strong track is acceptable if the rest of the profile is excellent.

Must-have: technical fluency in data architecture and threats

• Understands how PII flows through cloud infrastructure, data platforms and AI/ML systems, and the main threats to that data.

• Credible with Engineering, Data and Cybersecurity: can discuss data architecture and system-level risk and translate legal requirements into practical guardrails, without owning those frameworks.

Has solid expertise in cross-border data transfer and vendor agreements

• Experience negotiating or reviewing data processing agreements and cross-border transfer clauses with cloud/tech vendors such as AWS.

• Has resolved tension between legal risk and commercial vendor relationships in a fast-moving environment.

AI practitioner, not just an enthusiast

• Must-have: proven experience implementing AI flows for legal or privacy work (e.g., triage of routine consultations, DPA or contract review), going beyond using off-the-shelf chat tools.

• Understands AI governance end to end, across both product AI (models, automated decisions, agents) and internal AI tool use, including vendor risks such as shadow AI and data retention by AI tools.

Demonstrated background operating as a player-coach

• Sets policy direction and personally executes, without relying on a team of direct reports.

• Manages external advisors effectively for surge or specialized capacity.

Track record of prioritizing by actual risk exposure across a wide mandate

• Runs a recommend-and-escalate model for day-to-day PII/product decisions while leading broader multi-stakeholder governance reviews.

• Earns the trust of senior leadership through integrity and sound judgment on material risk calls.
  

Why Join us?

• Work on a problem that truly matters – We are redefining how people shop, pay, and bank in Colombia, breaking down financial barriers and empowering millions. Your work will directly impact customers' lives by creating more accessible, seamless, and fair financial services.

• Step 1: People Interview (30 min)
  A conversation with a recruiter to get to know you, your experience, and what you’re looking for. We’ll also share more about Addi, our culture, and the role.

• Step 2: Initial Interview (45 min)
  A conversation to explore the privacy programs you’ve led, how you’ve worked with regulators like the SIC, and how you’ve balanced regulatory risk with business speed. We’ll also talk about how you’ve used AI in legal and privacy work.

• Step 3: Deep Dive (45 min)
  A conversation about how you work with teams like Data, Cybersecurity, and Engineering. You’ll show how you turn legal requirements into practical guidelines and stay a trusted partner, not a bottleneck.

• Step 4: Business Case (60 min)
  A practical exercise where you’ll work through a real-world privacy scenario, such as reviewing a cloud vendor data processing agreement with a cross-border transfer, and plan how you would prioritize your first months. We’ll evaluate how you prioritize by risk, your technical and vendor judgment, and the clarity of your recommendation.

• Step 6: Co-Founder Interview (30 min)
  If there’s a strong match, you’ll have a final conversation with our Founder to align on expectations, cultural fit, and make sure the excitement is mutual. From there, we’ll move quickly to an offer and discuss next steps.