Privacy Engineer

Privacy Engineer at 1Password

1Password is experiencing rapid growth, having surpassed $400M in ARR and consistently earning a spot on the Forbes Cloud 100 for four consecutive years. We are building the foundation for a safe, productive digital future, with a mission to enhance employee productivity without compromising security. We achieve this by ensuring authentic identities, secure application sign-ins, and trusted devices. As a market leader in enterprise password management and pioneer of Extended Access Management, 1Password is trusted by over 180,000 businesses globally.

We are seeking a Privacy Engineer to join our Privacy Engineering team within GRC, part of the broader Security organization. This role focuses on delivering privacy-by-design controls and tooling using full-stack engineering skills, helping 1Password maintain privacy-preserving practices across our product and platform in a modern SaaS environment.

What You Can Expect

• A hands-on engineering role within the Privacy Engineering team, focused on building real controls, not just policy.
• Work on critical privacy engineering problems impacting user-facing flows, APIs, services, and infrastructure handling customer data.
• Build practical privacy guardrails across the stack including data minimization, purpose limitation, access boundaries, and consent-aware collection.
• Improve data retention/deletion workflows and logging/telemetry hygiene.
• Help enable privacy-safe AI-assisted features by implementing technical guardrails.
• Collaborate across teams to make privacy the default through patterns, templates, and guardrails.

What You'll Do

Build privacy-by-design into product features and services

• Partner with Product and Legal/Privacy to translate requirements (e.g., DPIAs/PIAs, consent, data subject rights) into concrete Privacy Engineering deliverables.
• Implement privacy-safe patterns for data flows, access boundaries, storage decisions, and user experiences.
• Contribute to technical designs and reviews to address privacy early.

Implement privacy controls across the stack

• Build and improve backend controls such as authorization checks, data scoping, encryption usage, and privacy-aware service interfaces.
• Enhance frontend experiences supporting privacy requirements like clear choices and user controls.
• Improve data handling in logs/telemetry by limiting sensitive fields and ensuring consent-aware collection.

Improve lifecycle controls and operational hygiene

• Strengthen retention and deletion across production databases, logs, and third-party systems with an engineering-first approach.
• Improve observability practices while reducing data exposure (e.g., safer diagnostics, redaction).
• Build and maintain tooling and automation (service templates, CI checks) to prevent regressions and promote safe choices.

Grow through hands-on execution and collaboration

• Contribute production-quality code, tests, and documentation for privacy-related features.
• Participate in code and design reviews, iterating towards pragmatic solutions.
• Learn and apply privacy and regulatory concepts in an engineering context.

What We're Looking For

• 3–5 years of experience building and shipping software in a SaaS environment.
• Full-stack engineering experience delivering customer-facing functionality and supporting backend services.
• Proficiency in one or more backend languages (e.g., Go, Rust, Java, TypeScript).
• Experience with modern web application patterns (authentication/authorization, API design, frontend state).
• Practical experience implementing privacy- and security-adjacent controls (data minimization, access controls, encryption, retention).
• Ability to translate privacy requirements (GDPR / CCPA / CPRA) into engineering tasks.
• Strong collaboration skills with GRC & Security, Product, Legal/Privacy, Data, and Engineering teams.
• Track record of writing reliable, maintainable code with testing and operational awareness.

Bonus Points For

• Experience building or supporting data subject rights workflows and automation.
• Familiarity with threat modeling, secure development practices, and privacy/security reviews.
• Exposure to compliance/security frameworks and audits (e.g., ISO 27001, ISO 27701, SOC 2).
• Interest in privacy-safe AI-assisted features (data minimization, provenance, logging).

Compensation

The annual base salary for US-based roles is between $123,000 USD and $172,000 USD, plus benefits, PTO, and an equity grant. For Canada-based roles, the annual base salary is between $111,000 CAD and $155,000 CAD, plus benefits, PTO, and an equity grant. Compensation is determined by fair market value and internal equity commensurate with experience and skills.

Our Culture

At 1Password, we prioritize collaboration, transparent communication, receptiveness to feedback, and alignment with our core values: keep it simple, lead with honesty, and put people first. We challenge the status quo and strive for excellence in a fast-paced environment, seeking adaptable, curious individuals driven to make an impact.

How We Work With AI

We are committed to leveraging AI responsibly to achieve our mission, encouraging team members to learn best practices, identify opportunities, and drive innovative solutions with AI. Candidates are welcome to use AI tools responsibly during the application process.

Our Approach to Remote Work

1Password is a remote-first company founded in 2005, with expertise in building remote culture. While remote, travel for in-person engagement is part of most roles, including annual department offsites, team meetings, and customer/industry events. Remote work means working from your home country.

What We Offer

• Health and wellbeing: Maternity and parental leave top-up, competitive health benefits, generous PTO.
• Growth and future: RSU program, retirement matching, free 1Password account.
• Community: Paid volunteer days, peer-to-peer recognition, remote-first work environment.

Key skills/competency

• Privacy Engineering
• Full-Stack Development
• SaaS Environment
• GDPR / CCPA / CPRA
• Data Minimization
• Access Controls
• Data Retention
• API Design
• Secure Development
• GRC (Governance, Risk, and Compliance)