Senior Managing Counsel, Privacy & Cybersecurity (Americas)

Overview

A healthcare organization is seeking a Senior Managing Counsel for Privacy & Cybersecurity to lead legal support for privacy and cybersecurity efforts across its USAC and LATAM operations. This role involves advising IT, cybersecurity, business, and functional teams, as well as external partners, to manage legal risks related to data security and privacy. The position reports to the Chief Privacy Officer and the Vice President of Information and Digital and is based in the United States.

Responsibilities

• Provide expert legal counsel to Privacy and Cybersecurity teams to ensure compliance with contractual commitments and regulatory obligations related to data privacy and security.
• Conduct privacy and data protection impact assessments to ensure sensitive health data is used in compliance with privacy regulations and contractual rights.
• Advise cybersecurity teams on incident response and investigations, ensuring proper documentation to minimize risks, protect privacy, and fulfill legal obligations during and after security incidents.
• Collaborate with Procurement and business contracting teams to draft, negotiate, and maintain privacy/data protection terms in contracts and agreements.
• Lead the company’s legal response to product vulnerabilities, information security breaches, and cyber events, including advising on regulatory notifications at federal, state, and international levels.
• Counsel IT operations, security teams, and business units on developing and implementing cybersecurity plans, incident response strategies, and compliance with industry standards and regulations.
• Work closely with Cybersecurity, Procurement, and Legal teams to manage third-party risks, including creating contract templates, negotiation frameworks, and advising on third-party audits and assessments.
• Advise on the de-identification, pseudonymization, and anonymization of sensitive health data.
• Provide guidance to business and product teams on data handling requirements based on sensitivity and compliance standards.
• Implement “privacy by design” principles in product development processes and contribute to product risk assessments.
• Stay informed on emerging global regulatory requirements impacting data privacy and security and advise the business accordingly.
• Develop and provide legal content for privacy training programs, awareness campaigns, and compliance with sensitive health information handling requirements.

Requirements

• Juris Doctor (JD) or equivalent law degree from an accredited institution.
• Minimum of 8 years of experience in data privacy and cybersecurity law, preferably within life sciences, healthcare, medical devices, or similarly regulated industries.
• Expertise in global data privacy laws, including GDPR and AI laws such as the EU AI Act.
• Expertise in US data privacy laws and regulations, including HIPAA and state consumer privacy laws (e.g., CCPA, CPA).
• Experience advising on cybersecurity matters including product vulnerabilities, incident response, and legal obligations arising from privacy and security incidents.
• Familiarity with cybersecurity standards such as PCI DSS and the NIST Cybersecurity Framework.
• Must be legally authorized to work in the United States without sponsorship.

Preferred Qualifications

• Experience with Canadian and LATAM data privacy laws and regulations, including LGPD, PIPEDA, and the Privacy Act.
• Familiarity with medical device regulations related to data privacy and security (e.g., FDA, FD&C Act).
• Experience managing HIPAA compliance programs and addressing legal issues related to health data.
• Experience working with IT systems, data management, and collaborating with technical teams and senior leadership.
• Strong written, verbal, and presentation skills with the ability to communicate complex legal matters clearly to non-legal stakeholders.
• Excellent analytical and strategic thinking skills.
• Highly organized, detail-oriented, and committed to ethical standards and professionalism.
• Ability to prioritize multiple projects and work under tight deadlines in a fast-paced environment.
• Relevant privacy and cybersecurity certifications (e.g., CIPP/US, AIGP, CIPP, CIPM, CIPP/E, CIPT, CHPS, CHPC, CISSP) are preferred but not required.
• Extensive experience negotiating and drafting technology transactions and data protection agreements.
• Proven leadership skills and ability to engage internal stakeholders and lead significant projects.
• Client-focused with strong internal relationship management skills.
• Experience in or with the life sciences industry is preferred.

Compensation & Benefits

• Expected compensation range: $211,600 - $290,950 (base pay plus variable incentive pay, if eligible).
• Compensation varies based on knowledge, training, skills, work location, and experience.
• Eligible for a range of benefits including medical, dental, vision, health savings accounts, flexible spending accounts, disability benefits, life insurance, voluntary benefits, paid absences, and retirement benefits.

Location

• Remote position based in the United States.
• May require up to 20% domestic and international travel.
• Relocation assistance is not authorized.

Additional Information

• Compliance with corporate policies, procedures, and security standards is required.
• The employer is an equal opportunity organization and does not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or veteran status.
• Applicants must provide education and work history either by uploading a resume or entering information directly into the application.
• Candidates are advised to be cautious of fraudulent job postings and recruitment schemes.
• The position does not involve work in unincorporated areas of Los Angeles County.