Sr. Associate General Counsel, Cyber Security and Privacy - Remote

Overview

A health care and well-being organization is seeking a Senior Associate General Counsel specializing in Cyber Security and Privacy. This role involves providing high-quality, pragmatic legal counsel on a broad range of cybersecurity, privacy, and data protection matters. The position serves as the front-line lead attorney on cybersecurity events and works closely with various internal teams to ensure compliance with evolving privacy and cybersecurity regulations.

This role offers the flexibility to work remotely from anywhere within the U.S. However, for hires in Minneapolis or Washington, D.C., a minimum of four days per week in-office work is required.

Responsibilities

• Provide legal support on privacy, cybersecurity, and data protection issues, including compliance with HIPAA, state privacy laws, U.S. federal privacy/security laws, and emerging global privacy regulations.
• Support compliance efforts related to cybersecurity, privacy, and data security frameworks and regulations such as NYDFS.
• Monitor changes in state and federal laws and develop practical recommendations for business operations, vendor engagements, and product development.
• Assist in drafting, updating, and operationalizing privacy, cybersecurity, and data protection policies, procedures, standards, and guidelines.
• Lead and manage cyber events and investigations from discovery through forensics and fulfillment of state and federal notice requirements.
• Support cyber incident preparedness and response, including participation in tabletop exercises and incident assessments.
• Evaluate incidents involving personal or confidential data, privacy/security investigations, and regulatory reporting obligations.
• Monitor, interpret, and assist with implementation of new and emerging privacy, cybersecurity, and data protection laws.
• Review and advise on IT development, acquisition, and data architecture matters such as data localization and cross-border transfers.
• Support legal analysis for insider risk and Red Flags program requirements.
• Collaborate with Enterprise Security & Resiliency Office teams, Technology, Corporate Security, Communications, and other legal partners to provide coordinated guidance.
• Assist business leaders in understanding privacy and cybersecurity risks and recommended mitigations.
• Provide consultative legal support to help business teams comply with privacy and cybersecurity expectations.
• Develop and deliver legal training related to privacy, cybersecurity, data protection, and information risk management.
• Support day-to-day operational legal needs within the Enterprise Privacy Office and Enterprise Security & Resiliency Office.
• Assist with preparing materials and documentation for internal audits, stakeholder briefings, or regulatory inquiries.

Required Qualifications

• Minimum of 8 years of experience in privacy, cybersecurity, data protection, or related regulatory legal practice.
• Experience with HIPAA Security Rule.
• Solid understanding of U.S. federal and state privacy/security frameworks, including HIPAA and state breach notification laws.
• Demonstrated ability to lead and manage cyber investigations and breaches.
• Proven ability to work effectively across large, matrixed organizations.

Preferred Qualifications

• Experience advising on cybersecurity regulatory frameworks such as NYDFS and SEC cybersecurity regulations.
• Experience supporting large-scale healthcare, insurance, technology, or security operations.
• Experience supporting enterprise privacy and security programs within regulated industries.
• Familiarity with global privacy regulations, including GDPR and APAC privacy laws.
• Strong drafting, communication, and cross-functional partnership skills.

Compensation & Benefits

• Salary range: $159,300 to $273,200 annually, based on full-time employment.
• Compensation is influenced by factors including local labor markets, education, work experience, and certifications.
• Comprehensive benefits package including incentive and recognition programs, equity stock purchase, and 401(k) contributions (subject to eligibility).

Location

• Remote work available anywhere in the U.S.
• For Minneapolis or Washington, D.C. hires, in-office presence required at least four days per week.

Additional Information

• Candidates must comply with the organization's telecommuter policy if working remotely.
• The organization is an equal opportunity employer and complies with all applicable laws regarding nondiscrimination.
• Employment is contingent upon passing a drug test prior to starting.
• The job posting will remain open for a minimum of two business days or until a sufficient candidate pool is collected; it may close earlier due to volume of applicants.