Corp Counsel III (Privacy, Digital Risk, and Cybersecurity)

Overview

This role supports the Privacy Office as Corporate Counsel III (Privacy, Digital Risk, and Cybersecurity). The attorney advises on compliance with applicable privacy, cybersecurity, and digital legal requirements and industry frameworks, including U.S. state privacy laws, HIPAA and HITECH, PCI DSS, and NIST.

The position serves as the team’s principal legal specialist for cybersecurity regulatory compliance, partnering with privacy and digital risk counsel to provide practical, risk-based guidance to business teams, AI & Data Analytics, and the Legal team.

Responsibilities

• Monitor and interpret developing privacy and cybersecurity laws and industry frameworks to support regulatory compliance.
• Provide legal oversight and guidance on digital compliance risks, including:
  • Website and application terms & conditions
  • Online tracking technologies
  • Digital accessibility requirements
  • Digital asset disclosures
  • Employee data access policies
• Support enterprise innovation and growth by incorporating privacy, cybersecurity, and digital compliance-by-design principles from the outset of initiatives.
• Conduct enterprise legal risk reviews across privacy, cybersecurity, and digital matters, including:
  • Privacy impact assessments
  • Data subject rights requests
  • Supplier privacy reviews
  • Vendor cybersecurity assessments
  • AI impact assessments involving privacy, cybersecurity, or digital compliance issues
• Modernize and develop digital and data legal and governance materials, including digital policies, procedures, and an overall risk governance framework across privacy, cybersecurity, and digital.
• Counsel Security and Technology teams on legal aspects of security and privacy incident investigations, including mitigation, response, and regulatory reporting, partnering with internal stakeholders and external parties as needed.
• Serve as a primary legal specialist for privacy, cybersecurity, and digital regulatory compliance and risk for the AI & Data Analytics Office and Legal.
• Maintain related policies and contract templates.
• Draft and negotiate specialized or complex contract terms related to privacy, cybersecurity, and digital compliance.
• Monitor evolving privacy, cybersecurity, and digital legal requirements and advise relevant stakeholders on their impact.
• Translate applicable regulatory requirements into practical, scalable processes and controls supporting supplier privacy and vendor cybersecurity assessments, privacy impact assessments, privacy-related cybersecurity audit requirements, online privacy and digital compliance, and specialized privacy and cybersecurity contract negotiations.

Required Qualifications

• 7+ years of applicable experience
• Juris Doctorate
• Active license in good standing to practice law in at least one U.S. jurisdiction, with eligibility to serve as in-house counsel as required.

Preferred Qualifications

Skills and Experience

• One or more relevant privacy or AI governance certifications, such as CIPP/US, CIPP/E, CIPM, or CIPT.
• Experience operationalizing privacy, AI, and digital risk programs and related processes.
• Familiarity with OneTrust, Transcend, or similar privacy or AI governance platforms.
• At least 5 years of relevant legal experience (preferably 5 to 7 or more years) advising on privacy, cybersecurity, digital compliance, technology, or related regulatory matters in a law firm, in-house legal department, government agency, or comparable environment.
• Substantive knowledge of U.S. privacy and data protection laws, including:
  • HIPAA and HITECH
  • state comprehensive privacy laws
  • state consumer health data laws
  • data breach notification laws
  • requirements governing the collection, use, disclosure, retention, and protection of personal information
• Demonstrated experience interpreting cybersecurity laws, regulations, and recognized cybersecurity frameworks, including the ability to identify legal, regulatory, and compliance requirements under authorities and frameworks such as FISMA, NIST, and PCI DSS and translate them into practical guidance.
• Hands-on experience conducting or providing legal oversight for privacy and digital risk assessments, including privacy impact assessments, records of processing activities, data subject request workflows, supplier privacy reviews, vendor cybersecurity assessments, and assessments of new products, technologies, data uses, or business initiatives.
• Experience advising on digital compliance matters, including website and application privacy disclosures, online tracking technologies, cookies and consent requirements, digital terms and conditions, consumer-facing data practices, and accessibility-related legal requirements.
• Experience supporting privacy and cybersecurity incident response, including legal assessments, coordinating investigation and mitigation activities, determining contractual and regulatory notification obligations, preparing/reviewing notifications, and working with affected business partners, customers, regulators, forensic providers, notification vendors, and outside counsel.
• Experience drafting, reviewing, and negotiating privacy, cybersecurity, and data protection provisions in commercial agreements, including:
  • data processing agreements
  • business associate agreements
  • cybersecurity addenda
  • incident notification provisions
  • international data transfer terms
  • privacy and cybersecurity requirements in customer and supplier contracts
• Experience advising business, product, technology, data, and cybersecurity stakeholders during design or implementation of new products, services, systems, vendors, and data uses, identifying requirements early and recommending practical controls or mitigations.
• Experience developing, implementing, or materially improving privacy, cybersecurity, or digital governance programs, including policies, standards, procedures, assessment methodologies, templates, decision records, escalation protocols, training materials, and compliance workflows.

Compensation & Benefits

• Internal salary range: $141,000 - $234,000
• Final salary depends on market factors, including departmental budgets, internal equity, education, unique skills/experience, and geographic location.

Qualifying full-time and part-time employees receive access to:

• Health, dental, vision, life and disability insurance
• 401k retirement program
• Paid time off
• Participation in employee incentive plans
• Tuition reimbursement and professional development opportunities

Location

• Remote
• Travel: 1–20% within the US

Additional Job Requirements / Working Conditions

• Remain in a stationary position for prolonged periods of time.
• Adapt to changing priorities quickly; meet deadlines.
• Attention to detail.
• Operate computer programs and software.
• Communicate effectively with audiences in person and in electronic formats.
• Day-to-day contact with others (co-workers and/or the public).
• Make independent decisions.
• Work collaboratively in a shared environment with peers and varying interruptions.

Physical Demands

• Sedentary: Exerting up to 10 pounds of force occasionally, and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves remaining stationary most of the time.

Equal Opportunity

The employer is an equal opportunity employer and provides reasonable accommodations to qualified individuals with a disability or those with a sincerely held religious belief.