Associate General Counsel, Privacy – Remote (USA) (993-SLS)

Our client, the company behind the fastest open-source analytical database in the world and a mission-driven, fast-growing private cloud company and leader in real-time analytics, data warehousing, and data observability, has exclusively engaged Solutus Legal Search to assist its executives in hiring an attorney to serve as Associate General Counsel, Privacy.

The Role: Reporting to the General Counsel, this attorney will own the company’s global privacy legal function, serving as the company’s principal legal advisor on domestic and international privacy and data protection matters, as well as be the Legal Team’s principal partner with the Security Team. This attorney will partner closely with business teams to develop and implement practical, business-oriented approaches to complex privacy issues and build scalable processes that support the company’s continued growth.

This is a build role: you will take a growing set of privacy obligations, customer commitments, and regulatory exposures and turn them into a coherent, well-documented program that scales with the business.  You will be the privacy expert in the room for product and engineering decisions, the person Sales and Legal turn to on DPAs and cross-border transfer questions and data flow mapping, and the legal lead alongside Security and GRC functions on security commitments, audits, and incident response.

You will operate as an individual contributor, with the expectation that you build a team as the program matures.  This role suits someone who is comfortable with technical depth. You will be reading data flow diagrams, asking engineers precise questions about where data is stored and who can reach it, and giving answers a product team can actually implement.

What You'll Do: Own the global privacy program

• Advise on domestic and international privacy and data protection laws and regulations, including GDPR, HIPAA, CCPA/CPRA, other U.S. state and international privacy laws, and international data transfer requirements.
• Own the data subject request process end to end, along with the privacy elements of vendor and subprocessor diligence.
• Track regulatory and enforcement developments across jurisdictions and translate them into concrete changes to our product, contracts, and internal practices — not just memos.
• Conduct and oversee privacy risk assessments, including data protection impact assessments (DPIAs), transfer impact assessments, and related documentation.
• Manage and build out the function
• Enhance and mature the company’s privacy program to continue meeting evolving regulatory requirements. Scale core program components with respect to data subject rights requests, privacy notices, consent management, impact assessments, and policy management.
• Maintain the program's operating machinery: records of processing, data inventories and mapping, retention schedules, DPIAs and transfer impact assessments, and privacy policies and notices.
• Deliver privacy and security training that people remember, and drive internal awareness across engineering, sales, marketing, partner relationships and support.
• Manage outside counsel and privacy vendors against a budget.
• Serve as, or manage the relationship with, our EU representative and data protection officer arrangements as required.
• Advise Marketing on adtech, cookies and tracking technologies, and electronic marketing compliance.
• Report to leadership on privacy and security risk and support Board and audit reporting on the program.
• Counsel product and engineering
• Embed with product and engineering teams as they design features, giving privacy-by-design guidance early enough to shape architecture rather than block launches.
• Advise on data residency and localization, telemetry and usage data, encryption and key management, access controls, logging, anonymization and pseudonymization, and retention and deletion mechanics.
• Advise on AI and machine learning features — training data provenance, customer data use restrictions, model and vendor terms, and emerging AI regulatory requirements.
• Support commercial contracting
• Own our DPA and its negotiation strategy, including standard contractual clauses, the UK IDTA and Addendum, and other transfer mechanisms; negotiate the privacy and security terms in customer and vendor agreements.
• Serve as escalation point for Legal and Deal Desk on privacy and security terms, and build the playbooks, fallback positions, and self-service guidance that let the rest of the team resolve most of these without you.
• Support enterprise, public sector, and regulated-industry deals with sector-specific requirements, including HIPAA business associate agreements and financial services and payments obligations.