Want to know if this job is worth applying to?
Bogotá, Bogotá, Distrito Capital, Colombia
Hybrid
We are a leading financial platform, building the future of payments, shopping, and banking—a world where consumers and merchants can transact effortlessly and grow together. Today, we serve over 3.6 million customers and partner with more than 55,000 merchants, making Addi Colombia’s fastest-growing marketplace.
With a state-of-the-art, technology-first approach, we provide banking solutions (deposits, payments, unsecured credit) and commerce services (e-commerce, marketing), bridging the financial gap for millions and redefining how people experience financial freedom. As the country’s leading Buy Now, Pay Later provider, we have secured regulatory approval to operate as a bank, unlocking even greater opportunities for our customers. In the past year, we have also achieved profitability, reinforcing the strength of our business model and our ability to scale sustainably.
Our mission has earned the trust of world-class investors, including Andreessen Horowitz, Architect Capital, GIC, Goldman Sachs, Greycroft, Monashees, Notable Capital, Quona Capital, Union Square Ventures, Victory Park Capital, and more, who back our vision for the future. With their support, we are not just growing—we are transforming Latin America’s financial ecosystem and shaping the next generation to shop, pay, and bank in Colombia.
But what truly sets us apart is how we build. We are a conscious company, driven by deep experience in scaling technology, services and products, and we live by our values every day.
This is where you come in. Below, you’ll find what this role is all about: the impact you’ll drive, the challenges you’ll tackle, and what it takes to thrive at Addi. If you’re ready to be part of something big, keep reading.
Drive Addi’s privacy and AI governance, as Data Protection Officer and trusted partner to the General Counsel and Head of Legal, to keep Addi compliant with Colombian regulation and in good standing with the SIC and SFC, ensuring the business can use data and AI lawfully, quickly, and with confidence.
Lead Addi’s privacy program across all of its entities. This includes assessing compliance against applicable regulations, defining priorities, and driving remediation.
Maintain a clear view of how personal data flows through the company, including legal bases, counterparties, and regulatory registrations. Keep it current as new products, entities, and funding structures appear.
Work with the Data and Cybersecurity teams to add a privacy layer to Addi’s data governance, covering data classification, legal basis for each use, retention, and data minimization.
Prepare and advise on incident response, including legal risk assessment, stakeholder coordination, and regulatory reporting.
Join product, alliance, and vendor discussions from the start. Review launches that touch personal data before go-live, in a way that helps the business move forward and doesn’t slow it down.
Negotiate and review data processing agreements and cross-border transfer terms with cloud and technology vendors.
Design and run an AI governance framework for both product AI (credit models, automated decisions, customer-facing agents) and internal AI tools. This covers use-case inventory, risk-based review, proportional approval paths, and rules for AI vendors.
Use AI tools to make legal and privacy work faster, for example to handle routine consultations and contract reviews, so you can focus on complex judgment calls.
Manage external advisors when you need extra or specialized capacity.
Represent Addi on privacy and AI matters before regulators, and take part in industry working groups and public consultations, including through Colombia Fintech.
Proven experience in Colombian data protection law and regulatory practice
Licensed lawyer with 10+ years of total legal/compliance experience, including at least 6 years specifically in data protection/privacy.
Direct experience interacting with the SIC (Superintendencia de Industria y Comercio) — filings, inquiries. Having worked at the SIC is a strong plus.
Nice to have: exposure to international frameworks (e.g., GDPR, Brazil's LGPD), given Addi's entities abroad and potential international expansion.
Track record of running privacy programs as a solo or near-solo function
Has operated as the sole or near-sole owner of a privacy function, not just as part of a large team.
Prior experience as a DPO, privacy counsel, or senior privacy/compliance lead, ideally in a regulated, high-growth environment (fintech, financial services, or consumer tech) OR prior experience working at the SIC. Both is ideal, but one strong track is acceptable if the rest of the profile is excellent.
Must-have: technical fluency in data architecture and threats
Understands how PII flows through cloud infrastructure, data platforms and AI/ML systems, and the main threats to that data.
Credible with Engineering, Data and Cybersecurity: can discuss data architecture and system-level risk and translate legal requirements into practical guardrails, without owning those frameworks.
Has solid expertise in cross-border data transfer and vendor agreements
Experience negotiating or reviewing data processing agreements and cross-border transfer clauses with cloud/tech vendors such as AWS.
Has resolved tension between legal risk and commercial vendor relationships in a fast-moving environment.
AI practitioner, not just an enthusiast
Must-have: proven experience implementing AI flows for legal or privacy work (e.g., triage of routine consultations, DPA or contract review), going beyond using off-the-shelf chat tools.
Understands AI governance end to end, across both product AI (models, automated decisions, agents) and internal AI tool use, including vendor risks such as shadow AI and data retention by AI tools.
Demonstrated background operating as a player-coach
Sets policy direction and personally executes, without relying on a team of direct reports.
Manages external advisors effectively for surge or specialized capacity.
Track record of prioritizing by actual risk exposure across a wide mandate
Runs a recommend-and-escalate model for day-to-day PII/product decisions while leading broader multi-stakeholder governance reviews.
Earns the trust of senior leadership through integrity and sound judgment on material risk calls.
Work on a problem that truly matters – We are redefining how people shop, pay, and bank in Colombia, breaking down financial barriers and empowering millions. Your work will directly impact customers' lives by creating more accessible, seamless, and fair financial services.
Be part of something big from the ground up – This is your chance to help shape a company, influencing everything from our technology and strategy to our culture and values. You won’t just be an employee—you’ll be an owner
Unparalleled growth opportunity – The market we’re tackling is massive, and we’re growing faster than almost any fintech lender at our stage. If you’re looking for a high-impact role in a company that’s scaling fast, this is it.
Join a world-class team – Work alongside top-tier talent from around the world, in an environment where excellence, ownership, and collaboration are at the core of everything we do. We care deeply about what we build and how we build it—and we want you to be a part of it.
Competitive compensation & meaningful ownership – We believe in rewarding our talent. You’ll receive a generous salary, equity in the company, and benefits that go beyond the basics to support your growth.
We believe in a fast, transparent, and engaging hiring experience that allows both you and us to determine if there's a great fit. Here’s what our process looks like:
Step 1: People Interview (30 min)
A conversation with a recruiter to get to know you, your experience, and what you’re looking for. We’ll also share more about Addi, our culture, and the role.
Step 2: Initial Interview (45 min)
A conversation to explore the privacy programs you’ve led, how you’ve worked with regulators like the SIC, and how you’ve balanced regulatory risk with business speed. We’ll also talk about how you’ve used AI in legal and privacy work.
Step 3: Deep Dive (45 min)
A conversation about how you work with teams like Data, Cybersecurity, and Engineering. You’ll show how you turn legal requirements into practical guidelines and stay a trusted partner, not a bottleneck.
Step 4: Business Case (60 min)
A practical exercise where you’ll work through a real-world privacy scenario, such as reviewing a cloud vendor data processing agreement with a cross-border transfer, and plan how you would prioritize your first months. We’ll evaluate how you prioritize by risk, your technical and vendor judgment, and the clarity of your recommendation.
Step 6: Co-Founder Interview (30 min)
If there’s a strong match, you’ll have a final conversation with our Founder to align on expectations, cultural fit, and make sure the excitement is mutual. From there, we’ll move quickly to an offer and discuss next steps.
We value efficiency and respect for your time, so we aim to complete the process as quickly as possible. Our goal is to make this experience insightful and exciting for you, just as much as it is for us. Regardless of the outcome, we are committed to always providing feedback, ensuring that you walk away with valuable insights from your experience with us.
