Corporate Counsel III (Privacy, Digital Risk, and AI Governance)

Overview

This role supports the Privacy Office as a Corporate Counsel III (Privacy, Digital Risk, and AI Governance). The attorney advises on compliance with applicable privacy, AI, and digital laws, regulations, and industry frameworks, including U.S. state privacy and AI laws, HIPAA and HITECH, the EU AI Act, and the NIST AI Risk Management Framework.

The position serves as the team’s principal legal specialist for AI regulatory compliance and partners with the Corporate Counsel III (Privacy, Digital Risk, and Cybersecurity) on privacy compliance and digital risk oversight. Responsibilities include providing practical, risk-based guidance to business teams, the AI & Data Analytics organization, and the Legal team.

The role will also help continuously improve and operationalize privacy, AI, and digital governance programs—translating regulatory requirements into scalable processes and controls that support privacy and AI impact assessments, AI use-case review and classification, AI governance, online privacy and digital compliance, and specialized privacy and AI contract negotiations. The attorney will monitor evolving privacy, AI, and digital legal requirements and advise stakeholders on their impact.

Responsibilities

• Monitor, interpret, and support regulatory compliance with applicable privacy and AI laws and related industry frameworks.
• Provide legal oversight and guidance for digital compliance risks, including:
  • Website and application terms & conditions
  • Online tracking technologies
  • Digital accessibility requirements
  • Digital asset disclosures
  • Employee data access policies
• Apply privacy, AI, and digital compliance-by-design principles to support enterprise innovation and growth.
• Conduct enterprise legal risk reviews across privacy, AI, and digital matters, including:
  • Privacy and AI impact assessments
  • Data subject rights requests
  • Supplier privacy reviews
  • Legal review and classification of AI use cases
• Modernize and develop the Digital & Data Legal and Governance organization, including digital and data policies/procedures and the overall risk governance framework across privacy, AI, and digital matters.
• Advise on privacy- and AI-related incidents, investigations, mitigation and response activities, regulatory reporting, and regulatory inquiries.
• Serve as a primary legal specialist for privacy, AI, and digital regulatory compliance and risk, including:
  • Maintaining related policies and contract templates
  • Advising on specialized or complex privacy, AI, and digital matters requiring subject-matter expertise
• Support enterprise governance by translating regulatory requirements into practical, scalable processes and controls supporting:
  • Privacy and AI impact assessments
  • AI use-case review and classification
  • AI governance
  • Online privacy and digital compliance
  • Specialized privacy and AI contract negotiations

Requirements

• Juris Doctorate (Required)
• 7 or more years of applicable experience
• Required Certification/Licensing: Active license in good standing to practice law in at least one U.S. jurisdiction, with eligibility to serve as in-house counsel as required.

Preferred Qualifications

• One or more relevant privacy or AI governance certifications, such as CIPP/US, CIPP/E, CIPM, CIPT, or AIGP.
• Experience operationalizing privacy, AI, and digital risk programs and related processes.
• Familiarity with OneTrust, Transcend, or similar privacy or AI governance platforms.
• At least 5 years of relevant legal experience (preferably 5 to 7 or more), advising on privacy, AI, digital compliance, technology, or related regulatory matters in a law firm, in-house legal department, government agency, or comparable environment.
• Substantive knowledge of U.S. privacy and data protection laws, including HIPAA and HITECH, state comprehensive privacy laws, state consumer health data laws, and other requirements governing the collection, use, disclosure, retention, and protection of personal information.
• Demonstrated experience interpreting AI laws, regulations, and recognized AI governance frameworks, including U.S. federal and state requirements, the EU AI Act, and the NIST AI Risk Management Framework, and translating them into practical guidance for AI, data, Technology, compliance, and business teams.
• Experience advising on the development, procurement, deployment, and use of AI systems, including:
  • Identifying the organization’s regulatory role as a provider, deployer, or other regulated participant
  • Evaluating prohibited, high-risk, or consequential decision-related use cases
  • Addressing transparency and human oversight requirements
  • Supporting related documentation and governance processes
• Hands-on experience conducting or providing legal oversight for privacy, AI, and digital risk assessments, including privacy and AI impact assessments, records of processing activities, data subject request workflows, AI use-case intake and classification, supplier privacy reviews, and assessments of new products, technologies, data uses, or business initiatives.
• Experience advising business, product, technology, AI, and data stakeholders during design or implementation of new products, services, systems, vendors, and AI use cases—identifying applicable requirements early and recommending practical controls or risk mitigations.
• Experience advising on digital compliance matters, including website and application privacy disclosures, online tracking technologies, cookies and consent requirements, consumer-facing data practices, and accessibility-related legal requirements.
• Experience drafting, reviewing, and negotiating specialized or complex privacy, AI, and technology provisions in commercial agreements, including:
  • Data processing agreements
  • Business associate agreements
  • Nonstandard AI provisions addressing permitted data and model uses, complex training restrictions, transparency, human oversight, monitoring, and regulatory allocation of responsibility
• Experience developing, implementing, or materially improving privacy, AI, or digital governance programs, including policies, standards, procedures, assessment methodologies, inventories, templates, decision records, escalation protocols, training materials, and compliance workflows.
• Education: Juris Doctorate

Compensation & Benefits

• Internal salary range: $141,000 - $234,000
• Final salary is dependent upon market factors including departmental budgets, internal equity, education, unique skills/experience, and geographic location.
• Benefits for qualified full-time and part-time employees:
  • Health, dental, vision, life and disability insurance
  • 401k retirement program
  • Paid time off
  • Participation in employee incentive plans
  • Tuition reimbursement and professional development opportunities

Location

• Working Conditions: Remote
• Travel Requirements: Travel 1-20% within the US

Additional Job Requirements / Work Conditions

• Remain in a stationary position for prolonged periods of time.
• Adapt to changing priorities quickly and meet deadlines.
• Strong attention to detail.
• Operate computer programs and software.
• Communicate effectively with audiences in person and in electronic formats.
• Day-to-day contact with others (co-workers and/or the public).
• Make independent decisions.
• Work collaboratively in a business environment in close quarters with peers and varying interruptions.
• Physical Demands: Sedentary work; exerting up to 10 pounds of force occasionally, and/or a negligible amount frequently or constantly to lift, carry, push, pull, or otherwise move objects (including the human body).