Sr Counsel Data Privacy & Protection

Overview

This senior counsel role supports the organization’s privacy, data protection, and AI program goals and compliance obligations across multiple business functions. Reporting to the Chief Litigation, Employment & Privacy Counsel, you will work closely with privacy and data governance leaders, information security, and the legal team.

You will serve as a subject-matter expert on state, federal, and international privacy laws and provide legal guidance on how these laws and regulations affect businesses in North America, South America, and European regions.

The position is fully remote within the US.

Responsibilities

• Serve as a key subject-matter expert and advisor to legal teams and business stakeholders on data privacy and protection law, including providing practical, timely, strategic, and high-quality legal advice.
• Advise legal and business teams on best practices and compliance with U.S. and global data protection laws, including legal and regulatory aspects of data collection and use, privacy disclosures and transparency, consent forms, and related issues.
• Collaborate with privacy and security colleagues to strengthen the organization’s privacy program, support consistent privacy practices, and minimize privacy risk.
• Support privacy impact assessments (PIAs/DPIAs), vendor risk reviews, and internal assessments using current data mapping and inventory information, collaborating with the Data Governance Manager as needed.
• Support the development and management of privacy training and awareness initiatives for employees.
• Provide legal support for reviewing, drafting, and negotiating AI, privacy, and data security terms in contracts with business partners and vendors, including data processing agreements and related data protection terms.
• Provide legal support for drafting, reviewing, and negotiating AI, privacy, and security-related agreements, including Business Associate Agreements, Data Processing Agreements, Data Protection Agreements, and Security Agreements.
• Provide advice and legal direction on data protection laws impacting business operations and contractual relationships.
• Strategically advise on emerging products and technologies while identifying and navigating privacy considerations.
• Provide legal counsel on investigations involving reports of inappropriate or unauthorized access, loss, or disclosure of personal data, including advising on potential liability, identifying legal obligations, and supporting incident response.
• Support enterprise-wide best practices for incident response readiness and advise on incident response activities (privacy and/or cybersecurity).
• Identify and advise on key legal issues requiring attention from the privacy compliance team and anticipate potential privacy legal issues within the organization.
• Counsel Information Security, Compliance, and other teams with privacy and data handling responsibilities to set strategy and manage complex privacy matters involving systems and data processing activities.
• Support the organization’s AI governance and responsible use framework, ensuring alignment with applicable privacy, data protection, and ethical use standards, while monitoring emerging AI-related privacy and data protection regulatory developments and escalating impacts to leadership as needed.
• Partner with Compliance, Data Governance, IS, IT, and business stakeholders to assess privacy risks associated with AI and automated decision-making systems.
• Support HIPAA Privacy compliance obligations, as applicable, including incident response and regulatory alignment.

Requirements

• JD degree and U.S. state bar membership in good standing are required.
• At least 8–12 years of experience as a practicing attorney (in-house and/or at a law firm), including at least 5–10 years of direct, hands-on experience providing legal counseling on data privacy and security matters.
• Understanding of relevant privacy statutes, regulations, and guidance, including comprehensive state privacy laws (e.g., CPRA, VDCPA), California Confidentiality of Medical Information Act (CMIA), state breach notification laws, HIPAA, EU General Data Protection Regulation (GDPR), TCPA, and CAN-SPAM.
• Substantial experience assessing legal risks related to data protection and privacy, including AI, and advising on practical, compliant ways to mitigate those risks.
• Experience drafting and negotiating AI, privacy, and security-related contracts and contract provisions.
• Experience with data loss prevention and cybersecurity events, including forensic investigations, breach notifications, and cybersecurity preparedness.
• Experience managing privacy and/or cybersecurity incident response efforts.
• Experience with privacy litigation and enforcement actions is a plus.
• Excellent negotiation and communication skills (oral and written) are required.

Preferred Qualifications

• Privacy and AI certifications are a plus, such as CIPP-US, CIPP-C, CIPP-E, CIPM, AIGP, CHPC, and other healthcare industry related credentials.
• Experience and interest in new and emerging technologies, including in healthcare and life sciences.
• Strong organization and teamwork skills; ability to multitask, prioritize, take initiative, lead projects, and work effectively independently and collaboratively.
• Detail-oriented, self-motivated, and able to motivate others.
• Strong commitment to integrity and professionalism, with demonstrated passion for excellence.

Compensation & Benefits

• $175,000–$205,500 depending on experience
• Medical, dental, and vision
• Life insurance
• 401(k)
• Paid time off

Location

• Fully remote within the US.