Director, Legal

Director, Privacy

Arctic Wolf is seeking an experienced privacy attorney to serve as Director, Privacy and take day-to-day ownership of our global privacy program. Reporting to the VP of Commercial & Privacy, you will be the hands-on owner of privacy compliance across our channel-led, SaaS-enabled cybersecurity business serving more than 12,000 customers worldwide.

This is a builder role for a pragmatic lawyer who translates evolving global privacy and data protection requirements into scalable processes. You will partner with Product and Engineering, Security, IT, People, Legal and other organizations to help shape privacy governance.

Responsibilities

• Own day-to-day operation of the global privacy program, including compliance with GDPR, CCPA/CPRA, other US state privacy laws, and other applicable regimes across the US, Canada, Europe, India and Australia, and monitor new laws and regulatory guidance to stay compliant ahead of effective dates.
• Draft, maintain, and improve privacy policies, notices, standards, records of processing, data maps, retention schedules, and internal guidance.
• Conduct and document data protection impact assessments, transfer impact assessments, and privacy reviews.
• Partner with our product counsel to embed privacy by design into our product development. Partner with Product and Engineering on data minimization, purpose limitation, transparency, access, sharing, and retention, and reviewing technical specifications and data flows with privacy implications.
• Serve as a primary privacy contact for security and privacy incidents, working with Security Operations and outside counsel to assess notification obligations and manage regulator and customer inquiries.
• Serve as an escalation point for commercial legal and sourcing teams on privacy terms in customer, partner, reseller and vendor agreements, and maintain data processing agreements, subprocessor disclosures, standard contractual clauses, and business associate agreements.
• Handle data subject requests, privacy escalations, and customer and prospect privacy diligence, and build playbooks, templates, and training so other teams can move quickly while staying compliant.
• Manage outside counsel and privacy tooling vendors, including scope, budget, and quality of work product.

Qualifications

• J.D. from an accredited law school and active membership in good standing with at least one U.S. state bar.
• Seven or more years of relevant legal experience, including substantial privacy and data protection work and meaningful in-house experience at a technology company.
• Deep working knowledge of GDPR, CCPA/CPRA, and other major global privacy frameworks, plus the emerging AI regulatory landscape.
• Demonstrated experience operating a privacy program, not only advising on one, including assessments, records of processing, data subject requests, vendor review, and advising Product and Engineering on privacy by design and technical data flows.
• Experience supporting privacy and security incident response, including breach analysis and regulator inquiries.
• Strong drafting and negotiation skills covering data processing agreements, standard contractual clauses, and privacy and security terms in commercial contracts.
• Excellent business judgment and a risk-based, solutions-oriented approach, with a demonstrated AI-first mindset, comfort with ambiguity, and a strong sense of ownership in a fast-moving environment.
• International Association of Privacy Professionals (IAPP) certification such as CIPP/US, CIPP/E, CIPM, or CIPT is strongly preferred.
• Experience at a cybersecurity, security software, or managed security provider, including security telemetry, log data, and threat intelligence data flows, and channel/MSP data-sharing arrangements.
• Experience with public sector customer privacy requirements across state, local, and education markets in the US, Canada, Australia, and Europe is preferred.