VP, Cyber, Privacy & Resilience Counsel

Morgan Stanley

Glasgow

On-site

GBP 120,000 - 150,000

Full time

14 days+

Application generator

An application made for this job — a tailored resume and cover letter that speak straight to the posting.

Get past ATS filters

Job summary

Morgan Stanley in Glasgow seeks a qualified lawyer with deep experience in data protection, privacy, operational resilience, fraud and cyber security matters across Europe, the Middle East and Africa. You will serve as a principal legal advisor to business units in EMEA, guiding complex regulatory obligations and strategic projects.

The role requires 7+ years in finance law, with strong knowledge of UK FCA/PRA OpRes rules, GDPR, DORA, NIS2 and related laws.

Qualifications

Qualified lawyer with 7+ years of experience.
Experience with financial services firms.
Deep knowledge of UK FCA/PRA OpRes rules, EU DORA, NIS2, Cyber Resilience Act, UK/EU GDPR.

Responsibilities

Serve as a principal legal advisor for cybersecurity, privacy and operational resilience matters to all Morgan Stanley entities in EMEA.
Assist in the development of a comprehensive cybersecurity, privacy, data, fraud and operational resilience framework for EMEA.
Partner with key stakeholders to provide strategic direction to the Firm in regulatory environment, especially for emerging technologies and strategic projects.
Advise on requirements and restrictions on the collection, storage and sharing of client and employee information including data localisation and data transfer restrictions.
Advise on restrictions on profiling, surveillance, monitoring and the use of tracking technologies.
Lead counsel responding to and managing cyber, fraud, information security and operational incidents, including notification obligations to regulators, clients and other third parties.
Advise on notices, disclosures, policies and procedures for privacy and information security, consistent with applicable laws and regulations in EMEA.
Advise on information requests including individuals exercising their privacy rights, regulatory investigations, litigation disclosures or other data requests by third parties.