VP, Associate General Counsel/Privacy Officer

Job Description

Job Description

Responsibilities

The Vice President, Associate General Counsel & Privacy Officer provides company-wide legal counsel in connection with AI governance, data privacy, HIPAA compliance, and cybersecurity risk management. The AGC will act as the Chief Privacy Officer and will be responsible for interfacing with the executive leadership team on all matters relating to privacy. This role is also responsible for supervising the company-wide system of contract management with support from a contract manager. The AGC ensures that all IT and vendor contracts for the company are reviewed, negotiated and tracked within our contract management system. This position will collaborate closely with the Chief Technology Officer, Chief Information Security Officer, Procurement function, the Executive Leadership Team, and other functional business areas as well as the attorneys, paralegals, and managers within the legal department assisting with any legal matters as needed. 

 

Functions & Responsibilities: 

• Commercial Contracting: Estimated 40% of Time: Lead legal review and negotiation of software licensing agreements, staffing agreements, consulting agreements, SaaS agreements, AI platform agreements, technology service agreements, business associate agreements, cybersecurity vendor contracts, general vendor contracts, and strategic partnerships. Advise procurement and business stakeholders on business, legal, privacy, and data security risks within those agreements.

• AI Governance & Responsible AI: Estimated 25% of Time :  Lead the organization's AI legal and governance strategy, in close collaboration with IT, Compliance and Operations. Develop and maintain AI governance frameworks, policies, and approval processes. Advise executive leadership on legal, ethical, and regulatory implications of generative AI, machine learning, and emerging technologies. Review and approve AI initiatives involving protected health information (PHI), employee data, or proprietary information. Monitor evolving federal and state AI regulations and assess organizational impacts. Support development of enterprise AI risk management practices aligned with industry frameworks such as the NIST AI Risk Management Framework.

• Privacy & HIPAA Compliance: Estimated 25% of Time :  Serve as legal advisor on HIPAA privacy, security, and breach notification requirements. Oversee breach response investigations and reporting obligations. Provide guidance regarding use, disclosure, retention, and protection of PHI and personally identifiable information. Oversee legal aspects of data privacy compliance, including HIPAA, HITECH, CCPA/CPRA, state privacy laws, and other applicable regulations. Partner with IT, Marketing, and other departments on privacy impact assessments and risk mitigation activities, including practices and policies regarding biometrics and data capture, collection, and tracking. 

• Technology & Cybersecurity: Estimated 10% of Time :  Provide legal oversight for cybersecurity governance and data protection strategies. Advise on incident response, ransomware events, data breaches, and regulatory reporting requirements. Review technology architecture, cloud computing arrangements, SaaS agreements, and enterprise software implementations. Support vendor risk management initiatives involving technology providers. Develop contractual and governance standards related to information security and data protection.

Qualifications

 

Must Haves

• Juris Doctor (J.D.) from an accredited law school.
• Active bar membership in good standing in the United States.
• 7+ years of legal experience with at least three years of full time (not contract) law firm experience. 
• Extensive training and experience negotiating high dollar IT and vendor agreements. 
• Strong drafting skills for complex and sophisticated matters. 
• Cutting edge expertise in advising clients on the use of AI and building enterprise AI governance programs. 
• Ability to identify changes in law and educate and train others on these changes.
• Comprehensive expertise in privacy and HIPAA compliance.
• Detail-oriented, organized, responsive and deadline-driven. 
• A fun and collaborative team player. 
• Mature self-starter. 

Preferred, but not Required

• Healthcare industry experience.
• Professional certifications such as CIPP/US, CIPM, CHPC, or another recognized information privacy credential. Must be willing to obtain such certifications. 

Experience managing other team members.