Privacy & Product Counsel

Hilbert's AI; San Francisco (CA); Hybrid; USD 250,000 - 350,000; Full time

Job summary

Hilbert's AI is seeking a Privacy & Product Counsel to embed with product and engineering, building privacy program end-to-end for an agentic AI platform across US/UK/EU. You’ll be the first dedicated privacy hire, advising on data handling, retention, and vendor oversight.

You’ll also handle enterprise contracts, DPAs, and security addenda, and guide product on privacy-by-design for new features. The role demands fluency in cross-border privacy law, strong negotiation, and a generalist mindset,

Qualifications

• 6–7 years of PQE in privacy and product/commercial counsel.
• Fluent across US, UK, and EU privacy law (CCPA/CPRA, UK GDPR, EU GDPR).
• Experience in data-intensive or AI company and enterprise contract negotiation.
• Ability to translate regulatory nuance into product decisions.
• Willingness to be a generalist, not only a specialist.

Responsibilities

• Design, build, and run Hilbert's privacy program end-to-end.
• Review and negotiate enterprise contracts, DPAs, and security addenda across US and UK/EU.
• Advise product on privacy-by-design for agentic features and human-in-the-loop disclosures.
• Partner with security on incident response and breach obligations.
• Be primary contact for enterprise customers' legal, security, and procurement teams.

Skills

Privacy law expertise

Enterprise contract negotiation

Product-influenced legal

Generalist

6–7 PQE

Job description

Hilbert is a scalable, data science-first growth engine that gives B2C teams predictive clarity into user behavior, revenue drivers, and the actions that drive sustainable growth. Fully agentic by design, Hilbert shrinks months-long decision cycles to minutes.

From Fortune 10 enterprises to beloved brands like FreshDirect, Blank Street, and Levain Bakery, operators run their growth on Hilbert. We're also co-building alongside leading AI companies.

We're looking for a Privacy & Product Counsel who can build Hilbert's privacy program from the inside of the product - not bolt one on after the fact - who is fluent across US, UK, and European privacy law, and who can move at the speed our engineering and GTM teams already move at, with the ownership and urgency of a startup culture.

You’ll be the first dedicated privacy hire, embedded with product and engineering as we design agentic systems that touch consumer data across dozens of enterprise environments and the person our biggest customers' legal and security teams call when they want to understand how our AI actually handles their data - wherever they're based. You’ll also be the generalist backstop for whatever legal question lands on the desk that week.

THE ROLE

You’ll work directly with the founding team and across product, engineering, and GTM to build and run Hilbert's privacy program end-to-end - while also owning the product and commercial legal work that comes with selling an agentic AI platform into enterprise accounts.

The environment is high-autonomy and high-ambiguity - new data types, new customer environments, and new AI capabilities show up faster than settled law does.

What you’ll do:

Privacy Program

• Design, build, and run Hilbert's privacy program - policies, data mapping, retention, and vendor/subprocessor management - from the ground up, covering both US and UK/EU entities and data flows

• Advise product and engineering on privacy-by-design for agentic workflows: what data an agent can access, retain, infer, or act on, and how that's documented and defensible under whichever regime applies

• Own compliance posture across CCPA/CPRA and the US state privacy patchwork, UK GDPR/DPA 2018, and EU GDPR, and track how state, federal, UK, and EU AI-specific rules are developing

• Build and maintain data processing agreements, international data transfer mechanisms (SCCs, UK IDTA/Addendum), and subprocessor frameworks that scale across enterprise customers without a bespoke redline every time

Product & Commercial Counsel

• Review and negotiate enterprise customer contracts, DPAs, and security addenda across US and UK/EU counterparties, working closely with sales to keep deals moving without compromising the company's data commitments

• Advise product on how new agentic features get built, marketed, and disclosed — including where an AI decision needs a human-in-the-loop checkpoint for legal or trust reasons

• Partner with security on incident response, breach notification obligations, and customer-facing security representations across jurisdictions

• Be the primary point of contact for enterprise customers' legal, security, and procurement teams when they ask how Hilbert's AI handles their data

WHO THRIVES IN THIS ROLE

The right person in this role is quick to turn regulatory nuance into a product decision and show up with both engineers and enterprise counterparts.

The profile:

• You have 6–7 years of PQE in privacy and product/commercial counsel, ideally split between in-house work at a data-intensive or AI company and enterprise contract negotiation.

• You're genuinely fluent across US, UK, and EU privacy law — CCPA/CPRA and the state patchwork, UK GDPR/DPA 2018, and EU GDPR.

• You think like a product person, not just a lawyer. You'd rather sit in a design review and shape a data flow before it's built than redline it after.

• You've negotiated enterprise DPAs, security addenda, and cross-border transfer mechanisms directly.

• You're a genuine generalist, not just a specialist who's willing to help out.

Location

San Francisco or London, hybrid, with occasional travel for customer engagements and to work with the other office.

Compensation

Competitive salary + equity package, commensurate with experience.

The Hiring Journey

Short form Intro call Working session with product & engineering Team conversations Offer

Fast, human, no bureaucracy.