Compliance Engineer for COPPA, TCPA, CAN-SPAM

Description: A meaningful share of Grit's users are minors under 13, which puts this squarely in COPPA territory, and the platform sends recurring donor communications by text and email, which brings in TCPA and CAN-SPAM. We've already had our compliance approach reviewed by counsel and have a fully specified data model and business logic for both — this is an implementation role, not a "figure out what's required" role. Scope: Verifiable parental consent flow, including the specific pre-consent age-gate pattern described in the spec Per-purpose consent tracking (core service vs. non-integral third-party disclosures need separate consent records, not one blanket approval) A real, scheduled data-retention/deletion job — not just a policy document A shared suppression-list and frequency-cap system that both our admin notification system and our coach-level donor messaging check before every send — this has to be one shared mechanism both systems call, not two independently-built versions Required experience: Prior hands-on experience implementing COPPA and/or TCPA compliance in a real product — this is not a "read the law and wing it" role Comfortable working from a detailed legal/technical spec and flagging ambiguities rather than guessing Strong sense for building compliance checks as shared, centrally-enforced logic rather than scattered per-feature checks Deliverables: Working consent flow, retention job running on schedule, and the shared canSendToDonor()-style check wired into every relevant send path with test coverage proving it's actually enforced.