Corp Counsel III (Privacy, Digital Risk, and Cybersecurity)

Overview

This role sits within the organization’s Privacy Office and provides legal counsel on compliance with applicable privacy, cybersecurity, and digital laws, regulations, and industry frameworks. Responsibilities include serving as a principal legal specialist for cybersecurity regulatory compliance and partnering with privacy and digital risk colleagues on privacy compliance and digital risk oversight.

Responsibilities

• Monitor and interpret developing privacy and cybersecurity laws and industry frameworks to support regulatory compliance.
• Provide legal oversight and guidance on digital compliance risks, including:
  • Website and application terms and conditions
  • Online tracking technologies
  • Digital accessibility requirements
  • Digital asset disclosures
  • Employee data access policies
• Support privacy, cybersecurity, and digital compliance-by-design in enterprise innovation and growth initiatives.
• Conduct enterprise legal risk reviews across privacy, cybersecurity, and digital matters, including:
  • Privacy impact assessments
  • Data subject rights request workflows
  • Supplier privacy reviews
  • Vendor cybersecurity assessments
  • AI impact assessments involving privacy, cybersecurity, or digital compliance issues
• Help modernize and develop the Digital & Data Legal and Governance organization, including digital policies, procedures, and an overall risk governance framework across privacy, cybersecurity, and digital.
• Counsel security and privacy incident investigations, including mitigations, response activities, and regulatory reporting in partnership with internal stakeholders and external parties as needed.
• Serve as a primary legal specialist across privacy, cybersecurity, and digital regulatory compliance and risk for the AI & Data Analytics Office and Legal.
  • Maintain related policies and contract templates
  • Draft and negotiate specialized or complex contract terms related to these areas

Required Qualifications

• 7 or more years of applicable experience
• Juris Doctorate
• Active license in good standing to practice law in at least one U.S. jurisdiction, with eligibility to serve as in-house counsel as required

Preferred Qualifications

• One or more relevant privacy or AI governance certifications, such as CIPP/US, CIPP/E, CIPM, CIPT

• Experience operationalizing privacy, AI, and digital risk programs and related processes

• Familiarity with OneTrust, Transcend, or similar privacy or AI governance platforms

• At least 5 years of relevant legal experience, preferably 5 to 7 or more years, advising on privacy, cybersecurity, digital compliance, technology, or related regulatory matters in a law firm, in-house legal department, government agency, or comparable environment

• Substantive knowledge of U.S. privacy and data protection laws, including HIPAA and HITECH, state comprehensive privacy laws, state consumer health data laws, data breach notification laws, and other requirements governing collection, use, disclosure, retention, and protection of personal information

• Experience interpreting cybersecurity laws, regulations, and recognized cybersecurity frameworks, including translating requirements arising under authorities and frameworks such as FISMA, NIST, and PCI DSS into practical guidance for Cybersecurity, IT, compliance, and business teams

• Hands-on experience conducting or providing legal oversight for privacy and digital risk assessments, including privacy impact assessments, records of processing activities, data subject request workflows, supplier privacy reviews, vendor cybersecurity assessments, and assessments of new products, technologies, data uses, or business initiatives

• Experience advising on digital compliance matters, including website and application privacy disclosures, online tracking technologies, cookies and consent requirements, digital terms and conditions, consumer-facing data practices, and accessibility-related legal requirements

• Experience supporting privacy and cybersecurity incident response, including conducting legal assessments, coordinating investigation and mitigation activities, determining contractual and regulatory notification obligations, preparing or reviewing notifications, and working with affected business partners, customers, regulators, forensic providers, notification vendors, and outside counsel

• Experience drafting, reviewing, and negotiating privacy, cybersecurity, and data protection provisions in commercial agreements, including data processing agreements, business associate agreements, cybersecurity addenda, incident notification provisions, international data transfer terms, and privacy and cybersecurity requirements in customer and supplier contracts

• Experience advising business, product, technology, data, and cybersecurity stakeholders during the design or implementation of new products, services, systems, vendors, and data uses, with the ability to identify applicable requirements early and recommend practical controls or risk mitigations

• Experience developing, implementing, or materially improving privacy, cybersecurity, or digital governance programs, including policies, standards, procedures, assessment methodologies, templates, decision records, escalation protocols, training materials, and compliance workflows

Compensation & Benefits

• Internal salary range: $141,000 - $234,000
• Final salary is dependent upon market factors including departmental budgets, internal equity, education, unique skills/experience, and geographic location.
• Full-time and part-time employees also receive access to:
  • Health, dental, vision, life and disability insurance
  • 401k retirement program
  • Paid time off
  • Participation in employee incentive plans
  • Tuition reimbursement and professional development opportunities

Location & Working Conditions

• Remote
• Travel: 1–20% within the U.S.

Additional Job Requirements

• Remain in a stationary position for prolonged periods of time
• Adapt to changing priorities quickly and meet deadlines
• Attention to detail
• Operate computer programs and software
• Ability to communicate effectively with audiences in person and in electronic formats
• Day-to-day contact with others (co-workers and/or the public)
• Make independent decisions
• Ability to work collaboratively in a close-quarters environment with peers and varying interruptions

Physical Demands

• Sedentary: exerting up to 10 pounds of force occasionally, and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects (including the human body). Sedentary work involves remaining stationary most of the time.

Equal Opportunity

The organization is an equal opportunity employer and provides reasonable accommodations to qualified individuals with disabilities or those with sincerely held religious beliefs.