Who Governs Data in the AI Era? A Computational Analysis of the U.S. Privacy Workforce in Job Postings

1. Introduction

• AI governance comprises organizational and policy structures for overseeing AI systems and managing their risks.The paper connects this oversight to privacy risks from AI systems processing personal data and generating inferences and profiles.Source: §1 · p. 3
• The paper treats privacy as employers use the term in postings, including data protection, compliance, security, risk management, data governance, AI governance, and data ethics.This is an account of employer descriptions, not a normative definition of privacy.Source: §1 · p. 3
• Privacy research has largely focused on specific roles or industry reports, leaving limited evidence about day-to-day employer expectations in job postings.The study addresses the gap by examining how private-sector employers define privacy roles and the professionals they seek.Source: §1 · p. 4
• The study combines rule-based text mining and descriptive statistics with BERTopic analysis of 1,143 U.S. postings from LinkedIn and Indeed.The analyses cover explicit requirements and the broader thematic structure of job descriptions.Source: §1 · pp. 4–5
• Employers often integrate AI governance into existing privacy roles, combining accountability, risk management, compliance, and coordination across legal, technical, and governance functions.The study examines the roles and expectations employers associate with oversight in the labor market.Source: §1 · pp. 3, 5

2.1 The Rise of the Privacy Profession

• Privacy roles expanded alongside compliance needs and organizational investment, while AI governance has become a prominent privacy-management responsibility.By 2025, 77 percent of privacy teams reported active AI governance work, and 69 percent of chief privacy officers reported AI-related oversight duties.Source: §2.1 · pp. 6–7

2.2 Competencies and Roles of Privacy Professionals

• Research on privacy professionals remains limited, and it is unclear whether expanding responsibilities represent lasting professional change or temporary overlap.Prior work describes professionals as liaisons, educators, and cross-functional collaborators; reports also indicate that more than 80% have duties beyond their primary privacy role and 68% have assumed AI governance responsibilities.Source: §2.2 · p. 7

2.3 Job Postings as Workforce Data

• Job postings provide current signals of employer-valued skills and role classifications, but they may overrepresent highly skilled jobs and do not establish actual hiring outcomes.The study applies text mining and topic modeling to examine employer demand in large volumes of free-form postings.Source: §2.3 · pp. 8–9

3. Methodology

• The two-phase workflow applies structured extraction and descriptive analysis alongside BERTopic modeling to the same corpus of 1,143 postings.The first phase extracts requirements such as education, certifications, regulations, competencies, and salary; the second prepares text for topic analysis.Source: §3 · p. 9, Figure 1 · p. 9

3.1 Data Collection and Scope

• A posting qualified when it was U.S.-based, used a privacy-focused title, and explicitly described privacy responsibilities; the final filtered corpus contained 1,143 unique postings.The researchers collected 2,254 listings from LinkedIn and Indeed between June and August 2025, then removed postings lacking substantive or complete descriptions.Source: §3.1 · pp. 9–10

3.2 Study 1: Extraction and Measurement

• Rule-based pattern matching extracted seven variable categories using dictionaries informed by the NIST taxonomy, IAPP credentials, and major laws and frameworks.A 100-posting review added terms to the dictionaries but assessed coverage rather than extraction accuracy; reported counts are matched-pattern occurrences, not validated accuracy measures.Source: §3.2 · pp. 11–12

3.3 Study 2: Topic Modeling with BERTopic

• BERTopic was used to identify broader patterns after text preprocessing, with MiniLM embeddings, UMAP dimensionality reduction, HDBSCAN clustering, and c-TF-IDF topic terms.The final 18 topics emerged from HDBSCAN rather than a preset topic count, and researchers assigned labels through consensus coding.Source: §3.3 · pp. 12–13

4.1 Role Landscape

• 22 title families appear, with Privacy Counsel (59) and Privacy Analyst (48) most common and no title appearing more than 59 times.Compliance-focused titles are also common, suggesting some privacy work is advertised under broader compliance labels.Source: §4.1 · pp. 13–14, Table 1 · p. 14

4.2 Salary Distribution

• $146,467 mean and $135,425 median annual salaries reflect a right-skewed distribution among postings disclosing compensation.The disclosed range is $29,120–$371,000; these postings are not a random subset and may overstate broader workforce salary central tendency.Source: §4.2 · pp. 15–16, Figure 2 · p. 15

4.3 Certifications

• 373 postings mention CIPP, the most frequent certification, followed by CIPM (251) and CIPT (169).Security and governance credentials also appear, while AIGP is mentioned 16 times.Source: §4.3 · p. 16, Figure 3 · p. 17

4.4 Education and Experience

• Degree requirements appear in 73 percent of postings; STEM and computing fields lead educational mentions, while 35 percent request four to six years of experience.Business and law-related fields also appear frequently, and 29 percent seek one to three years of experience.Source: §4.4 · p. 17

4.5 Competencies

• Communication (1,030 mentions), collaboration (856), and leadership (784) each outpace any individual technical competency, while cloud technologies appear in 599 postings.Privacy impact assessment appears in 107 postings, Python in 96, SQL in 66, and privacy-enhancing technologies in 35; employers expect work across organizational and technical domains.Source: §4.5 · p. 18, Figure 4 · p. 19, Figure 5 · p. 19

4.6 Regulations and Standards

• GDPR (594), HIPAA (525), and CCPA (472) are the most-mentioned regulations, while NIST appears 322 times among frameworks.These references suggest regulatory literacy extends beyond one jurisdiction and place privacy roles within wider enterprise governance structures.Source: §4.6 · pp. 19–20, Figure 6 · p. 20

4.7 AI Mentions

• Artificial intelligence appears in 51 percent of postings, and 68 job titles explicitly include “AI.”Examples show AI governance or AI legal duties added to existing privacy roles, consistent with privacy leaders’ growing AI oversight responsibilities (IAPP 2024a).Source: §4.7 · p. 20

5. Study 2 Findings: Latent Themes from Topic Modeling

• Topics 0 and 1 together account for 38.4 percent of postings, and the 18-topic model was grouped into four categories.Topic 0 features compliance, security, risk, and management; Topic 1 features compliance, privacy, health, and healthcare. Figure 7 shows topic word scores, with bar length indicating c-TF-IDF weight.Source: §5 · p. 21, Figure 7 · p. 21

5.1 Compliance and Risk

• Five Compliance and Risk topics cover regulatory compliance, risk mitigation, healthcare privacy, AI/ML monitoring, and links between privacy and security operations.Security Compliance and Risk Management (Topic 0) accounts for 20.2 percent of postings, while Healthcare Privacy Compliance (Topic 1) accounts for 18.2 percent; AI/ML Risk Monitoring (Topic 7) accounts for 3.8 percent.Source: §5.1 · pp. 23–24

5.2 Governance and Management

• Five Governance and Management topics range from global privacy programs and data governance to business-process support, executive leadership, and data stewardship.Data Governance and Management (Topic 3) covers policy design, AI governance, and privacy standards; Global Privacy Management (Topic 2) accounts for 9.8 percent of postings.Source: §5.2 · p. 24

5.3 Legal and Regulatory

• Six Legal and Regulatory topics span privacy-law advice, AI oversight, breach response, regional compliance, advertising law, and data protection in business operations.AI Legal Governance (Topic 10) accounts for 1.7 percent of postings; the other listed topics each account for 1.3–3.8 percent.Source: §5.3 · pp. 24–25

5.4 Engineering

• Two Engineering topics capture privacy and security implementation in software and organizational cybersecurity problem-solving.Privacy Engineering (Topic 5) accounts for 4.5 percent of postings and includes embedding controls and collaborating with development teams; Organizational Cybersecurity Challenges (Topic 16) accounts for 1.0 percent.Source: §5.4 · p. 25

6.1 What the Two Studies Show Together

• Rule-based extraction and topic modeling provide complementary views: postings combine interpersonal and technical competencies, and privacy work does not divide neatly into technical and non-technical roles.Communication, collaboration, leadership, and analytical skills are common requirements; cloud platforms, encryption, and privacy impact assessment each appear in more than 100 postings.Source: §6.1 · pp. 26–27

6.3 Workforce Identity and the Title Mismatch

• The 22 title families show no standardized privacy occupation, and technical responsibilities also appear under legal, compliance, and governance titles.No title appeared more than 59 times; studies relying on job titles alone may overlook technical privacy work listed under other roles.Source: §6.1 · p. 26, §6.3 · p. 28

6.2 Privacy Roles as Hybrid Governance Positions

• Privacy positions combine legal and technical expertise with communication, risk management, and organizational coordination, including AI governance responsibilities in many cases.The paper frames hybridity as duties spanning specialties within positions as well as responsibilities distributed across multiple organizational roles.Source: §6.2 · pp. 27–28

6.4 Institutional and Educational Implications

• U.S. postings reflect international regulation and security frameworks, while employers seek legal, technical, and interpersonal knowledge together.The postings also place AI risk, data protection, legal compliance, and system oversight across several position types; they cannot show how organizations distribute those responsibilities or assign accountability in practice.Source: §6.4 · pp. 28–29

7. Limitations

• The postings represent only a segment of the U.S. privacy labor market, collected from LinkedIn and Indeed during a three-month period in summer 2025.Because collection was retrospective, positions already filled, withdrawn, or expired were not included, and their absence cannot be assessed.Source: §7 · p. 29
• Privacy-focused search criteria exclude AI-governance roles advertised separately, so the findings do not establish the overall size or development of that workforce.Assessing whether distinct AI-governance occupations are emerging would require broader sampling.Source: §7 · p. 30
• Job postings describe employers’ recruitment expectations, not necessarily the responsibilities employees perform or the qualifications of those hired.Some requirements, especially communication and collaboration, may reflect standardized or aspirational wording.Source: §7 · p. 30
• Without a comparison corpus of non-privacy postings, the study cannot determine whether AI-related language is distinctive to privacy work.The findings support that AI responsibilities are widespread within privacy hiring, not that they are specific to the privacy workforce.Source: §7 · p. 30

8. Future Work

• Longitudinal collection could test whether current patterns persist, AI responsibilities increase, new titles emerge, or privacy roles specialize or remain connected to adjacent functions.The proposed comparisons include legal, security, and governance functions.Source: §8 · p. 31
• Matched non-privacy postings could establish whether AI language is distinctive to privacy hiring, while cross-jurisdictional comparisons could examine other regulatory settings.The proposed jurisdictions include the European Union and the United Kingdom.Source: §8 · p. 31
• Comparing job-posting expectations with privacy professionals’ interviews and surveys could reveal where advertised duties align with or differ from reported practice.The comparison could examine legal, technical, managerial, and AI-governance functions.Source: §8 · p. 31

9. Conclusion

• Employers often seek technical knowledge, regulatory expertise, and interpersonal skills, placing privacy work across multiple professional domains.The occupational landscape spans legal, technical, governance, risk, and managerial functions.Source: §9 · pp. 31–32
• AI-related language appears in 51 percent of postings and across compliance, legal, and governance topics rather than as a distinct occupational cluster.The authors describe AI governance as incorporated into existing privacy functions alongside data protection, compliance, risk management, and security.Source: §9 · p. 32
• The variety of job titles and responsibilities distributes AI-related work across several types of positions rather than one professional identity.The findings describe legal, technical, security, and managerial responsibilities intersecting with AI-related oversight.Source: §9 · p. 32
• The study provides an empirical view of how U.S. employers currently describe privacy roles and a foundation for research on their development over time.Source: §9 · p. 32

A. Search Keywords

• Each keyword was submitted to JobSpy with the location set to the United States, and retrieved postings underwent a dual title-and-description filter.Source: A. Search Keywords · pp. 32–33
• Search terms covered privacy engineers, analysts, officers, lawyers, compliance, data protection, and AI governance roles.The keyword list also included privacy and trust engineering, privacy program management, and data privacy and AI governance.Source: A. Search Keywords · p. 33
• The query list extended to security, risk, compliance, information governance, data strategy, and privacy-related management and counsel titles.It included terms such as “risk and compliance,” “associate general counsel, privacy,” and “information governance risk analyst.”Source: A. Search Keywords · p. 33

• Table 2 reports average and median salaries by city for cities with at least five postings.Source: Table 2 · p. 34
• The city-level salary comparison is limited to cities with at least five postings.Source: Table 2 · p. 34
• Table 3 presents degree expectations for the privacy workforce.Source: Table 3 · p. 35