Head of Legal & Compliance

Overview

This build-from-scratch role owns the organization’s legal and compliance approach across data handling, dialer and AI calling, and enterprise legal/security reviews. The position partners closely with Product and Engineering and helps shape requirements as part of the product conversation.

Responsibilities

Dialer & AI Calling Compliance

• Own the organization’s TCPA position and the state telemarketing statutes that stack on top of it, including:
  • Consent
  • DNC
  • Call recording
  • Disclosure rules around AI-generated voice
• Partner with Product and Engineering to ensure consent and suppression are enforced in the platform, not only documented
• Manage a specialist TCPA firm on retainer, including decisions on what to escalate versus handle in-house

Privacy & Data Sourcing

• Own the privacy program end to end, including:
  • GDPR
  • CCPA/CPRA and the expanding US state patchwork
  • DSARs
  • Opt-outs
  • Data broker registration
• Own data sourcing approaches and the legal bases for processing, including:
  • Supplier diligence
  • Lawful basis
  • Legitimate interest assessments
  • DPIAs
  • Transfer impact assessments
• Hold the DPO designation and set the approach to AI governance as more agentic features ship

Commercial & Enterprise Legal

• Draft and negotiate customer and vendor contracts, DPAs, and related agreements
• Own enterprise security and privacy reviews and remove them from the critical path of a deal
• Serve as the point of contact for customers’ counsel to help drive deal progress

Product Partnership

• Participate in roadmap planning and shape what gets built, rather than reviewing after the fact
• Translate regulatory constraints into clear product requirements the team can implement
• Identify upcoming regulatory considerations early enough to design for them, and distinguish between a real constraint and a cautious interpretation that slows execution

Requirements

• 8+ years combining law firm and in-house experience, qualified to practice in the US
• Deep, hands-on privacy experience with GDPR and CCPA/CPRA as tools used in practice (not only topics read)
• Proven experience advising Product and Engineering teams, with comfort participating in technical decision-making
• Track record building a legal or compliance function from scratch, with judgment about what to formalize versus leave alone
• Strong, direct communication skills, including the ability to make regulatory constraints understandable to non-legal stakeholders
• Experience in early-stage or high-growth environments, comfortable balancing strategic and tactical work
• Fluent in English

Preferred Qualifications

• TCPA, telephony, or dialer regulatory experience is a significant plus; if not present, interest in owning it
• Background at a sales-tech, B2B data, or privacy-tech company
• Certifications such as CIPP/E, CIPP/US, CIPM, or AIGP are welcome but not required
• Experience in Business Analytics (even if gained in college)

Compensation & Benefits

• Competitive salary
• Health insurance
• Stock options

Additional Information

• Annual company offsite

Location

Not specified.