The posting
Our client, the company behind the fastest open-source analytical database in the world and a mission-driven, fast-growing private cloud company and leader in real-time analytics, data warehousing, and data observability, has exclusively engaged Solutus Legal Search to assist its executives in hiring an attorney to serve as Associate General Counsel, Privacy.
The Role
What You'll Do
- Advise on domestic and international privacy and data protection laws and regulations, including GDPR, HIPAA, CCPA/CPRA, other U.S. state and international privacy laws, and international data transfer requirements.
- Own the data subject request process end to end, along with the privacy elements of vendor and subprocessor diligence.
- Track regulatory and enforcement developments across jurisdictions and translate them into concrete changes to our product, contracts, and internal practices — not just memos.
- Conduct and oversee privacy risk assessments, including data protection impact assessments (DPIAs), transfer impact assessments, and related documentation.
- Enhance and mature the company’s privacy program to continue meeting evolving regulatory requirements. Scale core program components with respect to data subject rights requests, privacy notices, consent management, impact assessments, and policy management.
- Maintain the program's operating machinery: records of processing, data inventories and mapping, retention schedules, DPIAs and transfer impact assessments, and privacy policies and notices.
- Deliver privacy and security training that people remember, and drive internal awareness across engineering, sales, marketing, partner relationships and support.
- Manage outside counsel and privacy vendors against a budget.
- Serve as, or manage the relationship with, our EU representative and data protection officer arrangements as required.
- Advise Marketing on adtech, cookies and tracking technologies, and electronic marketing compliance.
- Report to leadership on privacy and security risk and support Board and audit reporting on the program.
- Embed with product and engineering teams as they design features, giving privacy-by-design guidance early enough to shape architecture rather than block launches.
- Advise on data residency and localization, telemetry and usage data, encryption and key management, access controls, logging, anonymization and pseudonymization, and retention and deletion mechanics.
- Advise on AI and machine learning features — training data provenance, customer data use restrictions, model and vendor terms, and emerging AI regulatory requirements.
- Own our DPA and its negotiation strategy, including standard contractual clauses, the UK IDTA and Addendum, and other transfer mechanisms; negotiate the privacy and security terms in customer and vendor agreements.
- Serve as escalation point for Legal and Deal Desk on privacy and security terms, and build the playbooks, fallback positions, and self-service guidance that let the rest of the team resolve most of these without you.
- Support enterprise, public sector, and regulated-industry deals with sector-specific requirements, including HIPAA business associate agreements and financial services and payments obligations.
- Serve as legal counsel to the Security organization on our security commitments, control frameworks, and audit and certification programs — SOC 2, ISO 27001, HIPAA, PCI DSS, and the frameworks we take on next.
- Lead the legal workstream in security incident response: assess breach notification obligations across jurisdictions and contracts, manage regulator and customer notification, direct outside counsel and forensics under privilege, and run tabletop exercises with Security.
- Advise on law enforcement and government data requests, preservation obligations, and the policies governing how we respond.
- Support the GRC and Compliance functions on customer security questionnaires, trust center content, and the accuracy of our public privacy and security representations
Requirements:
- Strong academic credentials and membership in good standing with at least one U.S. state bar.
- 7-10+ years of relevant legal experience, with strong training at a top-rated national or international law firm. Law firm and in-house experience at a high-growth B2B SaaS company, preferably in the data infrastructure sector.
- Significant experience advising on domestic and international privacy and data protection matters.
- Deep knowledge of global privacy laws and regulatory frameworks, including GDPR, HIPAA, CCPA/CPRA, other U.S. state and international privacy laws, cross-border data transfer requirements, and evolving privacy and data governance regulations.
- Experience advising business and technical teams on privacy issues across the product lifecycle, including with respect to AI, machine learning, and emerging technologies, is strongly preferred.
- Experience supporting security matters, including with respect to customer-facing security commitments, security incident support, and related regulatory requirements, is preferred.
- Excellent judgment, strong business orientation, and ability to translate complex legal issues into practical advice.
- Strong interpersonal and communication skills and the ability to work effectively with executives and cross-functional stakeholders.
- Exceptional attention to detail, strong organizational skills, and ability to manage multiple priorities in a fast-moving, high-growth environment.
The current targeted base salary for this position ranges from $260,000 - $295,000, plus equity and a generous benefits package. Actual compensation is determined based on several factors, including a candidate’s qualifications, number of years of directly relevant experience, and location.
Solutus has been selected as the retained representative on this desirable search. Resumes submitted directly to our client will be forwarded to Solutus for review and evaluation.
Ref. #993-SLS
