Assistant General Counsel, Privacy Transformation, Trust & Operations (Remote)

Overview

A global cybersecurity leader is seeking an Assistant General Counsel, Privacy Transformation, Trust & Operations. This senior legal role reports directly to the Chief Privacy & Public Policy Officer and collaborates closely with the Privacy Assistant General Counsel (Data Protection & Policy). The position focuses on leading the privacy function’s AI transformation, customer trust initiatives, and operational improvements. It involves translating complex legal requirements into practical governance frameworks, scalable operating models, customer-facing trust assets, and defensible risk management processes. This role includes direct management of the Privacy Operations Specialist and oversight of relationships with alternative legal service providers. This is a strategic, builder role rather than a traditional privacy counsel position focused on routine legal review.

Responsibilities

• Lead AI transformation strategy for the privacy function, including AI-enabled workflows, automation, knowledge management, legal review controls, and responsible AI tool use.
• Develop legally reviewed guardrails for AI-assisted privacy tasks such as regulatory monitoring, content generation, DSAR triage, DPIA routing, contract comparison, incident summaries, and knowledge management.
• Ensure AI workflows maintain human ownership, legal judgment, privilege protection, traceability, auditability, data classification, and escalation protocols.
• Collaborate with Product Legal, Security, GRC, IT, Legal Operations, and others to identify privacy workflows suitable for automation or delegation.
• Own the Data Subject Rights (DSAR) operating model, including governance, workflow design, service levels, templates, quality controls, escalation, reporting, and continuous improvement.
• Manage the Privacy Operations Specialist responsible for day-to-day DSAR execution, coordination, tooling, reporting, and alternative legal provider workflow.
• Oversee strategic relationships with alternative legal service providers, including scope, escalation, quality, performance metrics, and business reviews.
• Partner to improve DSAR tooling, automation, intake routing, deadline tracking, documentation, metrics, and reporting.
• Develop DSAR playbooks, templates, decision trees, and escalation matrices to efficiently handle standard matters while preserving attorney control over complex issues.
• Own legal strategy for customer-facing privacy trust materials such as white papers, FAQs, trust center content, data processing explainers, AI/privacy narratives, privacy notices, certification summaries, and external claims.
• Translate privacy posture into clear, accurate, business-friendly materials supporting Sales, Customer Success, Commercial Legal, Product, Security, GRC, Marketing, and executives.
• Establish formal review and sign-off processes with Marketing Legal and other teams to ensure legal accuracy and commercial utility of customer-facing materials.
• Build a reusable library of privacy trust assets to reduce escalations and clarify data protection, AI, telemetry, subprocessors, cross-border transfers, retention, privacy-by-design, security data, and incident handling.
• Support strategic customer engagements involving privacy, AI, incident response, certifications, international transfers, or data-use questions.
• Ensure external privacy and data-practice claims are accurate, consistent, current, and aligned with contractual, regulatory, and operational realities.
• Partner with Privacy Leadership, GRC, Security, Compliance, Product, Engineering, and Legal stakeholders to support privacy-related certifications, audits, customer assurance requests, and control frameworks.
• Own privacy-specific certifications such as Data Privacy Framework, Global CBPR, APEC CBPR/PRP, and related assurance programs.
• Develop privacy evidence strategies linking internal controls to external commitments, customer diligence, regulatory expectations, and certification requirements.
• Create legally reviewed privacy narratives for certification topics including cross-border transfers, BCRs, SCCs, APEC CBPRs, subprocessor governance, retention, access controls, incident response, privacy-by-design, consent, and AI governance.
• Support readiness assessments and remediation planning for privacy control gaps.
• Serve as privacy legal partner to GRC and Security on control ownership, evidence quality, audit responses, and customer assurance.
• Lead privacy incident response as a senior legal advisor, partnering with CSIRT, Security, Legal, Compliance, Product, Communications, and outside counsel.
• Develop and maintain privacy incident response playbooks, escalation criteria, privilege protocols, documentation standards, decision trees, and remediation workflows.
• Advise on notification obligations, customer notices, regulator engagement, contractual reporting, and investigations related to privacy incidents.
• Ensure privacy incident records are accurate, defensible, privilege-aware, and compliant with regulatory and contractual obligations.
• Lead post-incident reviews to identify improvements in controls, policies, training, processes, products, and communications.
• Escalate high-risk privacy incidents to appropriate leadership.
• Own legal standards for cookies, tracking technologies, consent, preference management, and related notices, considering GDPR, ePrivacy, CCPA/CPRA, CAN-SPAM, CASL, and commercial messaging laws.
• Lead cross-functional consent framework involving Privacy, Marketing Legal, Marketing Operations, Product, Engineering, Web, Security, and others.
• Establish rules for cookies, pixels, SDKs, tags, analytics, advertising technologies, consent banners, preference centers, and regional consent experiences.
• Review and approve changes to cookie banners, consent flows, preference tools, tracking configurations, and privacy notices.
• Coordinate cookie scans and remediation to ensure compliance with notices and legal requirements.
• Translate privacy operational assessments into governance structures, playbooks, decision rights, workflows, and metrics.
• Clarify boundaries among Privacy, Privacy Assistant General Counsel, Product Legal, Marketing Legal, Commercial Legal, Security, GRC, Product, Engineering, Marketing, Legal Operations, Privacy Operations Specialist, alternative legal providers, and other stakeholders.
• Develop RACI models, escalation criteria, review protocols, and dashboards for cross-functional privacy matters.
• Identify work ownership between attorneys, Privacy Operations Specialist, alternative legal providers, automation, shared services, or operational support.
• Prepare regular reports for the Chief Privacy & Public Policy Officer on AI transformation, DSAR operations, alternative legal provider performance, customer trust materials, privacy incidents, certifications, cookie compliance, and consent governance.
• Support annual privacy program planning, budgeting, resource planning, executive updates, and transformation initiatives.

Requirements

• Juris Doctor (J.D.) degree and active bar membership.
• Significant experience in privacy, data protection, cybersecurity, technology, AI governance, or related fields.
• Strong knowledge of global privacy laws and regulations including GDPR, CCPA/CPRA, ePrivacy, breach notification laws, cross-border transfer requirements, and emerging AI governance obligations.
• Experience advising on privacy incident response including legal assessment, documentation, notification, remediation, and escalation.
• Experience with Data Subject Rights (DSAR) operations including workflow design, templates, identity verification, exceptions, escalation criteria, and SLA management.
• Experience managing legal operations professionals, privacy operations specialists, alternative legal providers, outside counsel, or other legal service delivery partners.
• Experience creating or reviewing customer-facing privacy materials such as white papers, FAQs, trust center content, privacy notices, certification narratives, or external data-practice claims.
• Excellent writing skills for customer-facing, executive-facing, and regulator-sensitive materials.
• Ability to collaborate effectively across Privacy, Security, GRC, Marketing Legal, Product Legal, Commercial Legal, Product, Engineering, Sales, Customer Success, IT, Legal Operations, and executive stakeholders.
• Strong program-building skills including playbook creation, governance design, metrics, escalation paths, and operating model development.

Preferred Qualifications

• Certifications such as CIPP/E, CIPP/US, CIPM, AIGP, or similar in privacy, data protection, or AI governance.
• Experience with privacy management platforms like OneTrust.
• Experience with consent management platforms, cookie scanning tools, trust centers, privacy automation tools, or DSAR automation.
• Experience with privacy-related certifications, assurance programs, BCRs, SCCs, APEC CBPRs, ISO/SOC support, or GRC control frameworks.
• Background in cybersecurity, cloud, SaaS, enterprise technology, threat intelligence, endpoint security, or security products.
• Experience implementing AI-enabled legal, privacy, compliance, or operational workflows with appropriate human review and governance controls.

Compensation & Benefits

• Base salary range for U.S. candidates: $210,000 - $300,000 per year.
• Eligibility for bonuses and equity grants.
• Comprehensive benefits package including health insurance, 401(k), and paid time off.
• Market-competitive compensation and equity awards.
• Physical and mental wellness programs.
• Competitive vacation and holidays.
• Paid parental and adoption leave.
• Professional development opportunities.
• Employee networks, neighborhood groups, and volunteer opportunities.
• Vibrant office culture with world-class amenities.

Location

This position is open to candidates in the United States. Specific location details are not provided.

Equal Opportunity Statement

The employer is committed to providing equal employment opportunities without discrimination based on race, color, creed, ethnicity, religion, sex (including pregnancy or related conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical or mental disability, medical condition, genetic information, membership in local human rights commissions, status regarding public assistance, or any other protected characteristic by law. Employment decisions are based on valid job requirements.

Reasonable accommodations are available upon request for applicants with disabilities during the application process.