Policy Engineering / Full-time
Senior Policy Engineer, Rego and Data Transfer Law
Turn GDPR Chapter V, the UK IDTA, revFADP and the EU AI Act into Rego policy packs that decide where every inference request may run.
Team
Policy Engineering
Location
Chennai or Frankfurt am Main
Type
Full-time
Posted
15 Oct 2026
- Own two or more of the pre-built policy packs, such as eu-gdpr-strict, uk-gdpr-idta and swiss-fadp-compliant, from legal analysis to merged Rego and release notes.
- Read primary sources (regulation text, adequacy decisions, EDPB guidelines and recommendations, supervisory authority decisions) and record the reasoning behind each rule in the pack's decision log.
- Write Rego that selects permitted endpoints and failover order, not only allow or deny, and keep median evaluation inside the team's 3 ms budget with benchmarks in CI.
- Build table-driven tests for every rule, including the edge cases customers' DPOs raise: remote access by support staff, EFTA members in a data zone, special category data under Article 9.
- Review customer custom policies with Customer Engineering and explain, in plain language, what a change does before it reaches production.
- Track regulatory change, such as new adequacy decisions or transfer regulations in the GCC, and ship pack updates with a written impact note.
- Four or more years in privacy engineering, privacy counsel or a technical DPO office, with hands-on work on international transfers under GDPR Chapter V.
- Working knowledge of Article 46 SCCs, transfer impact assessments and EDPB Recommendations 01/2020 on supplementary measures, and the ability to explain where they apply to an API call.
- Production experience with Open Policy Agent and Rego, or strong experience in another policy or rules language and the willingness to become fluent in Rego quickly.
- Comfort reading Go code and test output, and with Git-based review workflows.
- Clear written English. Your decision logs will be read by engineers, customers' counsel and auditors.
- CIPP/E, CIPT or an equivalent qualification.
- Familiarity with the UK International Data Transfer Agreement and Addendum, the Swiss revFADP, the Saudi PDPL or the UAE PDPL.
- Experience with the EU AI Act's obligations for high-risk systems or Annex IV technical documentation.
- German or French at a professional level.
- 01Application review
- 02Intro call
- 03Paid work sample
- 04Panel
- 05Offer