Assistant General Counsel - Data Regulation, Privacy, Security & Governance

cooley; United States; Hybrid; USD 180,000 - 300,000; Full time

Job summary

Cooley seeks an Assistant General Counsel to join the General Counsel's Office to lead data regulation, privacy, security and governance initiatives. The role advises on privacy laws, export controls, vendor contracts, and data governance across the firm worldwide.

The position requires collaboration with the C-SOC, DPO, and OGC, applying practical risk management and strong business acumen to support time-sensitive outcomes aligned with firm strategy.

Responsibilities

• Advise on data regulation and governance related to privacy, data security, records retention and cross-border transfers.
• Collaborate with Chief Security & Technology Officer and Chief Innovation Officer on privacy in vendor data.
• Prepare/update privacy and data governance policies to comply with GDPR and CCPA/CPRA; maintain notices.
• Provide privacy input on business projects as requested by DPO and OGC.
• Improve governance for client and firm data; develop policy for file handling, retention, records management.
• Support incident preparedness and response for privacy and data security with leadership.
• Act as cybersecurity subject matter expert with the cyber security team.
• Draft/review/negotiates data terms in client/vendor contracts; ensure privacy & security addenda.
• Perform or oversee privacy risk assessments (PRAs/DPIAs) and coordinate audits of high-risk third parties.

Job description

Assistant General Counsel - Data Regulation, Privacy, Security & Governance

Cooley is seeking an Assistant General Counsel to join the General Counsel's Office.

About Cooley:

Cooley is a global law firm with an expansive practice and more than 3,000 employees and partners worldwide. We value and celebrate diverse perspectives and strive to create a workplace where every individual can thrive. At the core of Cooley's success is the exceptional talent and unwavering spirit of our people. We embrace individuality while fostering a 'one-firm' culture where collaboration and creativity thrive. Our people are the foundation of our success and the driving force behind everything we do.

Hybrid Schedule Philosophy:

As part of the Cooley culture, we recognize and appreciate the value of being together, in person, to build comradery with others in the office and to be a contributing member of the Cooley office. However, we also appreciate the benefits and flexibility that come from remote working. As such, the default assumption for employees and partners is a hybrid schedule: some in-office presence and some work from home days.

Position summary:

Guided by department objectives and priorities, the Assistant General Counsel - Data Regulation, Privacy, Security and Governance develops, leads, and maintains the firm's legal strategy for data regulation, privacy, data security, data governance and data protection. The Assistant General Counsel will ensure appropriate use of data use and sharing; export controls, vendor and client data processing arrangements; and emerging regulatory frameworks and compliance with privacy regulations.

The role will prepare, implement, review, and update data-related and privacy-related policies and procedures; advise on compliance with U.S. state and federal privacy laws and global regimes (including GDPR and CCPA/CPRA); guide readiness for evolving data rules such as those governing bulk data, export controls and similar regulated data flows; and collaborate closely with the Office of the General Counsel, including the Client Engagement Counsel, the firm's Data Protection Officer, Technology, Innovation and other stakeholders. The Assistant General Counsel demonstrates strong business acumen, applied legal expertise, and global privacy fluency to support time-sensitive outcomes that align with firm strategy and risk posture. Specific duties include, but are not limited to, the following:

Position responsibilities:

• Advise the firm, in coordination with relevant stakeholders from Security, Technology, Innovation and other lawyers in the Office of the General Counsel, on data regulation and governance issues spanning privacy, data security, records retention and disposition as they relate to compliance with data laws, data inventories and maps, cross-border transfers, data subject requests, and lawful data use across firm operations and client interactions.
• Work closely with Chief Security & Technology Officer and Chief Innovation Officer on evaluating technology vendor data privacy.
• Prepare and update firm privacy and data governance policies and procedures to comply with applicable regulations, including GDPR and U.S. state privacy laws such as CCPA/CPRA, and maintain public-facing notices that reflect current legal and firm practices.
• Provide privacy input on business projects and initiatives as requested by the firm's Data Protection Officer and/or the Office of the General Counsel.
• Assist with continuing improvements to a sustainable governance framework for client and firm data, including policy development for client file handling and retention, oversight of records and information management as they relate to compliance with applicable data laws and regulations, and integration with information security and data governance functions.
• Support incident preparedness and response for privacy and data security events, including investigation, containment, remediation, notifications where required, and post-incident improvement in collaboration with the Chief Security & Technology Officer and firm leadership, as needed.
• Act as cyber security subject matter expert in close collaboration with cyber security tech team.
• Assist with drafting, reviewing, and negotiating data-related terms in client and vendor contracts, including data processing and transfer agreements, privacy-related clauses, and security addenda, applying advanced knowledge of global privacy regulations and contracting practices to manage risk and drive successful outcomes. Ensure key contracts, firm procurement initiatives and sourcing strategies are aligned with the overall priorities of the firm's legal function, paying special attention to privacy/data security and risk management practices as they develop.
• Perform or oversee privacy and data protection risk assessments, including PRAs and DPIAs where required, and coordinate compliance monitoring and audits of higher-risk vendors or third parties that process perso