Senior Counsel - Data Governance, Privacy and Cyber Security

AmerisourceBergen; Woking; On-site; GBP 60,000 - 100,000; Full time

Job summary

An innovative company is seeking a skilled attorney specializing in data governance, privacy, and cybersecurity. This role involves providing strategic legal advice on complex regulatory issues and collaborating with global teams to ensure compliance with evolving laws. The ideal candidate will have extensive experience in privacy and cybersecurity law, particularly within healthcare, and demonstrate strong analytical and communication skills. Join a forward-thinking organization where your expertise will help shape the future of data management and technology compliance.

Qualifications

• 5-7 years as a lawyer with expertise in cybersecurity and privacy/data governance.
• Experience with healthcare companies is a plus.

Responsibilities

• Advise on legal, regulatory, and policy questions related to data privacy and protection.
• Draft and negotiate contracts, especially data processing agreements.

Skills

Data Governance

Privacy Law

Cybersecurity

AI Regulations

Analytical Skills

Project Management

Stakeholder Communication

Negotiation Skills

Fluency in English

Soft Skills

Education

Qualified Solicitor or Equivalent

5-7 Years Legal Experience

Tools

Contract Management Software

Compliance Management Tools

Job description

Our team members are at the heart of everything we do. At Cencora, we are united in our responsibility to create healthier futures, and every person here is essential to us being able to deliver on that purpose. If you want to make a difference at the center of health, come join our innovative company and help us improve the lives of people and animals everywhere. Apply today!

Job Details

Position Summary

Cencora seeks an attorney with significant experience in data governance, privacy, cybersecurity, and emerging artificial intelligence issues to provide strategic legal advice on data risk management and innovation priorities. This role reports to the Assistant General Counsel - Data Governance, Privacy, and Cybersecurity and collaborates with legal, business, and functional teams across the enterprise.

While part of a global team, this role requires expertise in and frequent counseling on EU, UK, Swiss, and Asia-Pacific privacy, cybersecurity, and AI laws, regulations, and guidance. The candidate must have strong analytical skills and deliver pragmatic, business-oriented legal services in a fast-paced technology environment. Project management and prioritization skills are essential, along with the ability to provide strategic insights for compliance and governance in emerging data and technology law areas.

Primary Duties and Responsibilities

1. Advise on complex legal, regulatory, and policy questions related to data privacy and protection (GDPR, Swiss, UK, Asia-Pacific laws), cybersecurity (e.g., NIS2), and AI (including the EU AI Act).
2. Draft, review, and negotiate contracts, especially data processing agreements and privacy, cybersecurity, AI provisions; create templates and playbooks for efficient contract management.
3. Assess and mitigate harms from privacy and cybersecurity incidents through communication, escalation, and collaboration with stakeholders.
4. Review technology proposals involving privacy, cyber, and AI risks; provide pragmatic, creative solutions incorporating privacy and security by design.
5. Demonstrate decision-making and communication skills during time-sensitive incidents or high-risk proposals requiring escalation.
6. Manage multiple projects effectively, ensuring high-value and high-risk needs are addressed efficiently and strategically.

Experience and Education Requirements

Minimum 5-7 years as a lawyer with expertise in cybersecurity and privacy/data governance. Prior in-house experience and collaboration with multinational companies preferred. Experience with healthcare companies is a plus. Must be a qualified solicitor or equivalent from a reputable jurisdiction.

Minimum Skills, Knowledge, and Abilities

• Knowledge of privacy, cybersecurity, emerging AI laws across multiple jurisdictions, including cyber disclosures to regulators like the SEC. Healthcare laws are a plus.
• Ability to synthesize legal themes across jurisdictions for risk management advice in multi-country projects.
• Experience managing outside counsel and liaising with experts such as law firms, consultants, and forensic specialists.
• Ability to understand new business models and technology trends, aligning legal requirements with business strategies to future-proof investments.
• Experience advising senior management with clear risk assessments and mitigation strategies.
• Strong soft skills for incident management and risk escalation, projecting calm and confidence.
• Collaborative experience with compliance teams, advising on priorities and operational targets.
• Privacy, AI, or information security certifications (e.g., CIPP, CIPM, AIGP, CIPT, CISSP) preferred.
• Excellent negotiation, prioritization, multitasking, and client management skills, with ability to build strong relationships.
• Fluency in English required; additional languages like German, French, or Spanish advantageous.

What Cencora Offers

Benefits vary by country and are aligned with local practices. Eligibility and effective dates may differ, especially under collective bargaining agreements.

Affiliated Companies

Alliance Healthcare Management Services Limited

Equal Employment Opportunity

Cencora is committed to equal opportunity employment regardless of race, color, religion, sex, sexual orientation, gender identity, genetic information, national origin, age, disability, veteran status, or other protected classes. Harassment is prohibited, and all employment practices comply with non-discrimination principles.

We provide reasonable accommodations for individuals with disabilities during the employment process. To request accommodations, contact 888.692.2272 or [e-mail]. Requests are handled on a case-by-case basis. Messages unrelated to accommodation requests will not be responded to.