Description:

The Senior Corporate Counsel - Data Privacy & Compliance (Internal: Senior Manager - Legal & Compliance) serves as the primary legal authority and strategic advisor on data governance, cybersecurity risk, privacy compliance and emerging AI regulatory trends across digital, retail, finance and corporate operations. Reporting directly to the General Counsel, this role establishes enterprise privacy policies, directs legal response to cybersecurity incidents, oversees Data Privacy Impact Assessments (DPIAs), and steers the legal framework for Data Subject Access Requests (DSARs). Serving as a critical risk partner, this role liaises directly with supervisory authorities and external counsel while partnering with cross-functional teams to integrate privacy-by-design and responsible AI governance into corporate systems and commercial initiatives.

Responsibilities:

Regulatory Advice & Strategy: Serve as the subject matter expert on evolving domestic and international data privacy and security laws, advising leadership on legal risk, legislative trends and strategic compliance.
Incident Response & Cyber Legal Leadership: Direct the legal strategy for cybersecurity incidents and potential data breaches, overseeing privileged investigations, assessing notification obligations under strict statutory deadlines, and managing regulatory reporting.
Privacy-by-Design & DPIA Governance: Establish the legal framework for Data Protection Impact Assessments (DPIAs/PIAs) and partner with Product, Engineering, and Business teams to integrate privacy-by-design into new products, digital services, and AI initiatives.
Policy Architecture & Training: Draft, update, and operationalize enterprise-wide privacy and data security policies, governance standards, and employee compliance training programs.
Consumer Rights (DSAR) Escalations: Steer and oversee legal framework of the Data Subject Access Request (DSAR) program, advising on complex requests, statutory exceptions, and contentious data deletion or portability matters.
Regulatory Matters & Outside Counsel: Represent the company in inquiries, audits, and proceedings before data protection authorities, work with external counsel and industry associations on regulatory matters and the advancement of data protection standards.
Commercial Transactions & Vendor Oversight: Guide third-party risk management by advising on and negotiating complex Data Processing Agreements (DPAs), cross-border transfer mechanisms, and vendor data security terms.

About You:

Juris Doctor (J.D.) from an accredited law school and active license to practice law in good standing in at least one U.S. jurisdiction.7+ years of legal experience, providing solutions-oriented advice in a reputable law firm or in-house legal department.
Progressive professional experience in corporate data privacy law, cybersecurity, regulatory compliance, and/or information governance management.
IAPP certification (CIPP/US, CIPP/E or CIPM) strongly preferred.
In-depth expertise in evolving US federal and state privacy statutes and regulations (CCPA/CPRA, VCDPA, etc.), global data protection frameworks (e.g., GDPR), cross-border data transfer mechanisms, and regulatory enforcement trends.
Demonstrated capability in managing data breach incidents, handling regulatory inquiries, and conducting complex DPIAs across enterprise applications.
Strong legal judgment, analytical skills, issue spotting, organization and attention to detail.
Outstanding communication, analytical, negotiation, and cross-functional leadership skills, with a proven ability to translate technical privacy rules into actionable business guidance.

Physical Requirements:

Most work is performed in a temperature-controlled office environment.
Must be able to sit for prolonged periods of time at a desk or computer terminal.
May use keyboards, telephone, and standard office equipment in the course of a normal workday.
Stooping, bending, twisting, and reaching may be required in the completion of job duties.
Must be able to lift up to 25 pounds at times.

Competencies:

Personal Competencies: Proactively drives structural and procedural advancements within the regional department. Translates external developments into effective change initiatives, adapts confidently to dynamic changes, maintains a healthy balance between workload and capacity, and regularly reflects on performance to seek feedback.
Business Competencies: Derives specific goals and actionable steps based on macro corporate strategic objectives. Makes highly informed business choices by evaluating departmental KPIs, breaks complex problems down from multiple perspectives, and maintains active control over cost-benefit metrics.
Social Competencies: Communicates with absolute clarity, adapting styles flexibly to suit diverse audiences and persuade stakeholders. Nurtures trusting, cross-departmental relationships with other leaders, applies diplomacy to handle conflicts constructively, and conducts productive negotiations to find balanced compromises.
Leadership Competencies: Establishes an appreciative, trust-based, and learning-oriented working environment where mistakes are leveraged as growth opportunities. Actively identifies development needs to mentor team leads, and effectively delegates responsibilities using clear, transparent, SMART principles.