Senior Privacy & Security Commercial Counsel

Overview

A fast-growing legal AI platform is seeking a Senior Privacy & Security Counsel to lead privacy, data protection, and security compliance legal efforts. This role reports to the General Counsel and involves ownership of GDPR, CCPA, SOC 2, ISO certifications, DPA negotiations, and AI governance. The position offers the opportunity to influence privacy and security legal work at a technology company focused on legal AI.

Responsibilities

• Own the organization's privacy and security legal posture across all relevant regulatory frameworks.
• Serve as the internal subject matter expert for product, engineering, sales, and commercial legal teams on privacy and security matters.
• Lead negotiations of Data Processing Agreements (DPAs) and security addenda for enterprise deals.
• Develop and maintain privacy and security playbook positions to support company growth.
• Monitor and advise on emerging regulatory developments including AI governance and international privacy laws.
• Manage legal frameworks for SOC 2, ISO 27001, and ISO 42001 compliance programs in partnership with Governance, Risk, and Compliance (GRC) teams.
• Advise on privacy-by-design, data protection impact assessments, and AI governance requirements.
• Handle complex DPA and security addendum negotiations and maintain standard contract templates.
• Support enterprise sales through participation in security calls and responses to detailed inquiries.
• Manage relationships with external auditors and compliance vendors.
• Provide guidance on incident response, breach notification, and customer communications.
• Oversee legal review of Trust Center content, security marketing claims, and subprocessor disclosures.
• Advise on cross-border data transfers and jurisdiction-specific data protection requirements.
• Assist with other compliance projects including entity compliance management.
• Undertake additional projects as needed in a fast-growing startup environment.

Requirements

• Juris Doctor (JD) degree and active bar membership in at least one U.S. jurisdiction.
• 5-10 years of privacy and security legal experience, including significant in-house experience at a technology or SaaS company.
• Deep knowledge of GDPR, CCPA/CPRA, and other U.S. and international data protection regulations.
• Experience supporting B2B SaaS sales processes, including security reviews and customer-facing calls.
• Proven ability to negotiate DPAs and data protection terms, including GDPR Article 28 obligations and cross-border transfer mechanisms.
• Ability to work independently, prioritize competing demands, and perform under pressure.
• Comfortable working in a startup environment with ambiguity and shifting priorities.

Preferred Qualifications

• Privacy certifications such as CIPP/US or CIPP/E.
• Experience with AI governance frameworks (e.g., EU AI Act, NIST AI RMF) or ISO 42001.
• Hands-on experience supporting security compliance programs like SOC 2 or ISO 27001.
• Background in cybersecurity incident response or breach management.
• Experience at high-growth startups or scale-ups (Series B through pre-IPO).
• Prior experience at a major law firm in privacy, data protection, or technology transactions.

Compensation & Benefits

• Salary range: $170,000 to $225,000 annually.

Location

• This is a remote role unless located within approximately 50 miles of the San Mateo, CA or Provo, UT offices.
• For those within this radius, a hybrid schedule is required with in-office days on Tuesdays, Wednesdays, and Thursdays.

Equal Opportunity

The employer is an equal opportunity organization committed to workplace diversity and does not discriminate based on race, color, religion, gender identity or expression, national origin, age, military service eligibility, veteran status, sexual orientation, marital status, physical or mental disability, or any other protected class. Reasonable accommodations are provided to applicants with disabilities.