Jared Coseglia, founder and CEO of TRU Staffing Partners, kicked off April 2024’s episode of Eye on Privacy by welcoming featured guest Aaron Weller, a long-time expert in information security and privacy. Weller is currently the leader of HP’s Global Center of Excellence for Privacy Engineering. Coseglia invited Weller to start the webinar by introducing himself.

Aaron Weller: I’ve been at HP about 18 months now. The role is a bit different than what I’ve done before. I have been able to build a great team and we’re doing some exciting stuff not just around privacy technology. We’re doing a great deal of work in traditional privacy engineering areas and increasingly working with A.I. and innovation.

Coseglia: These are some of the topics we are tracking rigorously here at TRU in terms of what the data privacy industry job market looks and feels like on a global level.

A lot of the data we’re going to unpack today is in our 2024 Data Privacy Jobs Report. You can download it from the TRU website for free. It covers all of these topics with an analysis that takes us from 2020 to the end of 2023. We’ll share some of that data with you today.

So Aaron, let’s start by talking about where the jobs were in 2023 from a couple of different perspectives. Let’s do it by position, compensation, geography and role definition. What stands out to you in this data that may be interesting, surprising or disappointing?

Weller: What’s interesting in the position graphic is that more than a third are attorneys in the job market. Depending on who you ask, privacy roles have been mostly attributed to attorneys who really interpret the law and work out what has to be done. But as things have progressed and the industry has matured, we’ve seen some of these emerging roles like engineering, sales, and roles in the tools and technology market. These are roles that help to sell privacy back to other companies. It’s interesting to me that we have settled at about one third of positions belonging to attorneys, then almost a quarter of the positions being for program mangers or directors (who provide the organization we need to manage these kinds of programs), and then a smattering of other roles. I’m surprised that consultant positions are so low but that’s maybe my background in thinking that consultants are pretty much everywhere. Sales is very interesting. I don’t know that I have ever seen that broken out like that before. And it’s always good to see engineering coming through – those are the folks that get the privacy work done. Seeing that number at 10% is fantastic.

Coseglia: What is interesting about the sales sliver, which has gone up since 2022 – is that it’s a sign of a maturating marketplace in terms of the sales ecosystem. However, for the most part, most of the selling is still on the software or Big 4/Big 12 consulting firm side of the business or a very boutique side of the consulting service business with not a lot of ecosystem in the middle. The consultant positions at 15% have more to do with people who are not considered to be embedded inside a corporate program — so that’s third-party service providers or contractors who are coming in to have an impact but are not slated to become full-time employees. Back in 2018, that would have been 35-40% of the marketplace as we were gearing up for GDPR. When legislation is passed, those roles explode when smaller to mid-size companies hire to calibrate to meet new regulations.

As for the 35% for attorneys—the reason that percentage is so high is that many companies fired their engineers and operations staff as part of headcount reduction in 2023 or stopped hiring people at the same speed/rate they were in 2021/22. These roles you are seeing are as a result of companies having compliance-related issues and they tend to hire attorneys to manage those issues. 

Weller: People often ask: Where are the entry-level positions in privacy? You’ve clearly got some entry-level jobs on here. Are they US-based roles or in other places? This does look like global data — that may be why the information looks a bit strange.

Coseglia: This is global data but what we are seeing at that 5% sliver are non-European DPOs. The data represents entry-level privacy programmatic positions, which are generally non-attorney roles. It is still difficult to break into this industry as an entry-level person. Employers are looking to hire less experienced privacy pros, but not inexperienced people. We’re seeing customers hire at the lower end of the ranges.

We have also broken down this data by organization type (corporate, service providers/consulting firms, law firms, and software companies) and geography. The bulk of the privacy jobs are in the U.S. and within corporations. Anything jump out at you here, Aaron?

Weller: It’s interesting when you think the service providers and law firms are servicing the corporations — really everyone is. But the geographical breakdown is very interesting to me. Could you explain how this breaks down?

Coseglia: This is the total job market. TRU tracks all open data privacy requisitions worldwide. In 2023, we tracked only 19,000 open requisitions – that’s a 56% drop from 2022. We saw a much bigger shift to these jobs being in the U.S. Europe is fighting a horizontal regulatory battle. Here in the U.S., organizations are more focused on a vertical battle. The vertical battle is a bigger job creator in the ecosystem across varying levels of expertise than the pure compliance GDPR approach. It commoditized a lot of privacy work from a capital perspective. That’s why salaries in Europe are so low for DPOs. Here in the U.S., we are seeing salaries five to 10 times higher than what European DPOs make.

Stay tuned for Part 2 of this wide-ranging conversation between Jared Coseglia and Aaron Weller.