Description:

Build a Safer World.
TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure.

Legal Counsel, Privacy will own how TRM keeps Orion compliant with privacy and data-protection laws around the world, partnering directly with Product, Engineering, and GTM so the company can expand into new markets without slowing down. This is a build role: you will stand up the privacy program that lets a public-sector platform operate globally, and your judgment will directly shape what TRM can ship and where it can operate.

The impact you will have:

Determine whether TRM can launch Orion in a new jurisdiction by owning the privacy analysis end-to-end — using AI to draft DPIAs and transfer assessments so decisions land in days, not weeks.
Embed privacy-by-design into Orion's development lifecycle, partnering with Engineering to resolve data-flow and retention questions before they become launch blockers.
Lead and respond to data subject rights requests (DSARs) in coordination with Engineering and Customer Success.
Build and maintain the privacy program's core artifacts — records of processing, DPIA templates, and breach-response playbooks — using AI-assisted workflows so the program scales without adding headcount.
Run first-pass review of data processing agreements with AI, then finalize positions, cutting turnaround time on customer and vendor DPAs.
Design lawful cross-border data transfer mechanisms (SCCs, transfer impact assessments) that let Orion serve international customers with confidence.
Stand up a self-service privacy-review intake, supported by AI triage, so routine questions are answered quickly and only genuinely novel risk reaches deep legal review.
Support the CLO and AGC with clear, business-ready guidance that helps leadership make faster, better-informed decisions on privacy risk.

What We're Looking For:

4+ years of privacy and data-protection legal experience, with hands-on work applying GDPR and US state privacy laws to a technology product.
Active US bar admission; JD from an ABA-accredited law school.
Proven AI fluency: you use Claude, Gemini, or equivalent tools in your daily workflow and can design AI-assisted privacy processes — not just use AI for one-off research.
Experience counseling Product and Engineering teams on privacy-by-design, DPIAs, and data flows.
Familiarity with cross-border transfer mechanisms (SCCs, transfer impact assessments, adequacy analysis).
A collaborative, business-minded approach: you explain privacy risk in plain terms and work with partners to find a path forward rather than defaulting to no.
Comfort operating with ownership and limited oversight in a fast-moving environment.

About the Team:

TRM Legal is a lean, high-trust team that operates with high ownership and minimal hierarchy; each counsel owns their domain and is expected to advise proactively.
The Financial Times recently recognized the team as one of the "Most Innovative In-House Legal Teams" in North America, and the team is led by TRM's CLO, a former senior DOJ official.
AI tool adoption is a shared expectation — the team actively uses the Claude suite and similar tools to operate with the leverage of a much larger team.
Legal partners with Product, Engineering, and GTM as a business accelerator, not a bottleneck; you will be in the room shaping decisions early, not looped in after the fact.

Team Operating Rhythms:

The team is distributed across US time zones with core overlap during standard business hours; primary communication is async-first via Slack, with key decisions documented in Notion — distributed, not distant.
Weekly Legal team sync for cross-functional coordination; regular 1:1s with the AGC for prioritization and privacy program advisory.
TRM operates a high-transparency culture — program status and obligations are tracked in shared workspaces accessible to partner teams.

Learn about TRM Speed in this position:

Within the first 30 days, complete a full privacy assessment of an Orion feature and give Engineering a clear, actionable path to ship on schedule.
Within 60 days, stand up reusable DPIA and records-of-processing templates that cut time-to-first-draft on privacy artifacts by more than half.
Within 90 days, deliver a jurisdiction-readiness analysis that unblocks Orion's expansion into a new market.