2 months ago
London, United KingdomSenior
Responsibilities
- Serve as the engineering team’s primary point of contact for privacy, compliance, and regulatory matters.
- Embed data minimization, purpose limitation, and privacy-by-design into product architecture.
- Translate GDPR, HIPAA, the EU AI Act, and other regulations into technical requirements, guardrails, and continuously verifiable controls.
- Lead privacy and security design reviews, threat modeling, and risk assessments for features and models.
- Build privacy infrastructure covering data classification, policy-driven access controls, consent and preference management, audit logging, data lineage, and retention controls.
- Evaluate and apply differential privacy, de-identification, secure enclaves, and federated approaches.
- Develop reusable libraries, patterns, and tooling and mentor engineers on privacy and compliance practices.
- Partner with legal, compliance, security, and product teams to support audits, certifications, and regulator-facing evidence.
- Track emerging health-privacy regulations and incorporate them into engineering roadmaps.
Requirements
- Extensive professional software engineering experience building and operating production systems at scale, with significant depth in privacy, security, or data protection.
- Strong programming skills in at least one major language, such as C#, Python, Go, or Java, and experience shipping reliable backend and infrastructure systems.
- Ability to translate privacy and regulatory requirements into technical designs and enforceable controls.
- Hands-on knowledge of privacy-by-design, data minimization, RBAC/ABAC access-control models, encryption, audit logging, and data lifecycle management.
- Experience conducting privacy and security reviews, threat modeling, and risk assessments.
- Strong cross-functional communication skills with product, engineering, legal, and compliance stakeholders.
- Bachelor’s degree in Computer Science or a related field, or equivalent practical experience.
- Preferred experience in health technology or another highly regulated industry.
- Familiarity with HIPAA, HITRUST, ISO 27001/27701, NHS data governance, FHIR, and clinical data handling.
- Practical experience with privacy-enhancing technologies, AI/ML systems, sensitive-data training or inference, cloud platforms, and large-scale data systems.
- Relevant certifications such as CIPP/E or CIPT are preferred.
Benefits
- The role is based in the United Kingdom and has a typical base pay range of £93,500.00–£161,800.00 per year.
- Certain roles may be eligible for benefits and other compensation.
- Applications are accepted on an ongoing basis until the position is filled, with the posting open for at least five days.
About Microsoft
Microsoft develops operating systems, productivity software, cloud services, developer tools, and consumer devices for individuals, enterprises, and governments. Its main products include Windows, Microsoft 365, Azure, Visual Studio/GitHub, Xbox, and LinkedIn; revenue comes from software subscriptions and licenses, cloud consumption, hardware sales, and advertising. Founded in 1975 and headquartered in Redmond, Washington, Microsoft is a public company traded on Nasdaq.