Sr Counsel - Data Privacy & Protection

Overview

This role supports the organization’s privacy, data protection, and AI program goals, along with associated compliance obligations across multiple business functions. The position reports to the Chief Litigation, Employment & Privacy Counsel and works closely with the Privacy Officer and Data Governance Director, the Information Security Officer, and the legal team.

The role serves as a subject-matter expert for state, federal, and international privacy laws that impact business operations in North America, South America, and European regions.

This position is fully remote within the US.

Responsibilities

• Serve as a key subject-matter expert and advisor to legal and business teams on data privacy and protection law, providing practical, timely, strategic, and high-quality legal advice.
• Advise legal and business teams on best practices and compliance with U.S. and global data protection laws, including legal and regulatory aspects of data collection and use, privacy disclosures and transparency, consent forms, and related issues.
• Collaborate with privacy and security colleagues to enhance the organization’s privacy program, support consistent privacy practices, and minimize privacy risk.
• Support privacy impact assessments (PIAs/DPIAs), vendor risk reviews, and internal assessments using current data mapping and inventory information, in collaboration with the Data Governance Manager as necessary.
• Support development and management of privacy training and awareness initiatives to educate employees on privacy obligations, appropriate data handling, and regulatory requirements.
• Provide legal support for drafting, reviewing, and negotiating AI, privacy, and data security terms in contracts with business partners and vendors, including data processing and data protection provisions.
• Provide legal support for drafting, reviewing, and negotiating AI, privacy, and security-related agreements, including Business Associate Agreements, Data Processing Agreements, Data Protection Agreements, and Security Agreements.
• Provide advice and legal direction on data protection laws impacting business operations and contractual relationships.
• Strategically advise on emerging products and technologies while anticipating and managing privacy considerations.
• Provide legal counsel on investigations involving reports of inappropriate or unauthorized access, loss, or disclosure of personal data, including advising on potential liability, identifying legal obligations, and supporting incident response.
• Support development of enterprise-wide incident response readiness best practices and advise on incident response matters, whether privacy and/or cybersecurity related.
• Identify and advise on key legal issues requiring attention from the privacy compliance team and anticipate potential privacy legal issues across the organization.
• Advise Information Security, Compliance, and other stakeholders with privacy and data handling responsibilities to help set strategy and manage complex privacy matters involving systems and data processing activities.
• Support AI governance and responsible use framework alignment with applicable privacy, data protection, and ethical use standards; monitor emerging AI-related privacy and data protection regulatory developments (e.g., U.S. state laws, GDPR-adjacent obligations) and escalate impacts to leadership as needed.
• Partner with Compliance, Data Governance, IS, IT, and business stakeholders to assess privacy risks associated with AI and automated decision-making systems.
• Support HIPAA Privacy compliance obligations, as applicable, including incident response and regulatory alignment.

Required Qualifications

• JD degree and U.S. state bar membership in good standing.
• At least 8–12 years of experience as a practicing attorney (in-house and/or at a law firm), including at least 5–10 years of direct, hands-on experience providing legal counseling on data privacy and security matters.
• Understanding of relevant privacy statutes, regulations, and guidance, including comprehensive state privacy laws (e.g., CPRA, VDCPA), California Confidentiality of Medical Information Act (CMIA), state breach notification laws, HIPAA, EU General Data Protection Regulation (GDPR), TCPA, and CAN-SPAM.
• Substantial experience assessing legal risks related to data protection and privacy, and AI, including identifying and advising on practical, compliant mitigation approaches.
• Experience drafting and negotiating AI, privacy, and security-related contracts and contract provisions.
• Experience with data loss prevention and cybersecurity events, including forensic investigations, breach notifications, and cybersecurity preparedness.
• Experience managing privacy and/or cybersecurity incident response efforts.
• Privacy litigation and enforcement actions experience is a plus.
• Excellent negotiation and communication skills (oral and written).

Preferred Qualifications

• Privacy and AI certifications (a plus), such as CIPP-US, CIPP-C, CIPP-E, CIPM, AIGP, CHPC and other healthcare industry credentials.
• Experience and interest in new and emerging technologies, including in healthcare and life sciences.
• Strong organization and teamwork skills, ability to multitask, prioritize, take initiative, lead projects, and work effectively independently and collaboratively.
• Detail-oriented, self-motivated, and able to motivate others.
• Strong commitment to integrity and professionalism, with demonstrated passion for excellence.

Compensation & Benefits

• $175,000–$205,500, depending on experience
• Medical, Dental, Vision
• Life Insurance
• 401k
• Paid Time Off

Location

• Fully remote within the US.