Cybersecurity Legal Counsel: Incident Response & Tech Risk

Citizens; Boston (MA); On-site; USD 176,000 - 227,000; Full time

Job summary

Citizens is seeking an experienced Cybersecurity Attorney to join the Legal Cyber and Privacy team in Boston. You will provide strategic legal counsel on cybersecurity, data security, incident response, technology risk, and regulatory matters across the organization.

You will partner with Cyber Defense, Technology, Information Security, Risk, Compliance, Privacy, Communications, and the business to deliver practical advice, assess regulatory materiality, support incident communications, and help

Qualifications

• Juris Doctor degree from an accredited law school.
• Active license to practice law and membership in good standing in at least one U.S. jurisdiction.
• Experience advising on cyber incident response, including legal and regulatory materiality assessments, notification and disclosure obligations, regulatory engagement, and supervisory expectations.
• Strong knowledge of cybersecurity laws, regulations, regulatory guidance, and recognized cybersecurity and data-protection frameworks.
• Experience drafting and maintaining cybersecurity policies, incident-response procedures, standards, governance documents, or playbooks.
• Strong contract drafting and negotiation skills, particularly involving technology services, cybersecurity, data protection, software, cloud services, and third-party risk.
• Demonstrated ability to assess complex legal and regulatory risks and provide practical, business-focused advice.
• Excellent written, verbal, and analytical skills, with the ability to communicate complex legal and technical matters clearly to senior and executive leadership.
• Ability to manage multiple priorities and operate effectively in a fast-paced environment, including during significant cybersecurity incidents and other time-sensitive matters.

Responsibilities

• Provide strategic legal counsel on cybersecurity, data security, incident response, technology risk, and related regulatory matters.
• Serve as a primary legal advisor during cyber and data-security incidents, partnering with Cyber Defense, Technology, Information Security, Communications, Compliance, Risk, Privacy, and senior leadership.
• Advise on incident escalation, legal and regulatory materiality assessments, regulatory notifications, disclosure obligations, regulatory engagement, and related internal and external communications.
• Monitor and interpret evolving cybersecurity laws, regulations, regulatory guidance, and supervisory expectations and advise stakeholders on their impact to Citizens’ operations, technology environment, and risk-management practices.
• Support enterprise crisis-management activities, including escalation, response coordination, internal governance, regulatory engagement, and communications during significant events.
• Draft, review, and maintain cybersecurity and incident-response policies, standards, procedures, governance documents, and playbooks.
• Provide legal guidance for cyber tabletop exercises, readiness assessments, and cross-functional simulations designed to strengthen incident-response capabilities and operational resilience.
• Serve as legal advisor to the Bank’s Red Team, providing practical, risk-based guidance regarding penetration testing, adversarial simulations, threat-emulation activities, and other cybersecurity testing.
• Advise on cybersecurity and data-security requirements applicable to third-party service providers and technology integrations, including contractual protections, due diligence, incident-notification requirements, vendor oversight, and regulatory expectations.
• Serve as legal advisor to the Bank’s Open Source Office, providing guidance regarding the use, development, modification, licensing, and distribution of open-source software, including open-source software used or provided by third-party vendors.
• Draft, review, and negotiate technology, cybersecurity, data-security, cloud, software, and related commercial agreements.
• Partner with business and control functions to identify legal risks and develop practical, business-aligned solutions that support Citizens’ strategic and operational objectives.

Skills

Strong contract drafting andNegotiati​

Excellent written and verbal communic​

Analytical skills

Multi-priority management in fast pace

Education

Juris Doctor degree

Job description

Citizens is seeking an experienced Cybersecurity Attorney to join the Legal Cyber and Privacy team in Boston. You will provide strategic legal counsel on cybersecurity, data security, incident response, technology risk, and regulatory matters across the organization.

You will partner with Cyber Defense, Technology, Information Security, Risk, Compliance, Privacy, Communications, and the business to deliver practical advice, assess regulatory materiality, support incident communications, and help