Senior Privacy Counsel

EngineersOfAI; Northern (KY); On-site; USD 180,000 - 240,000; Full time

Job summary

Abnormal AI, an AI-native cybersecurity company, is seeking a Senior Privacy Counsel to own major portions of our global privacy program — shaping policy, guiding product and engineering on privacy by design, and coordinating cross-border data protection efforts.

Reporting to the AGC, PPIP, you will drive DSARs, DPIAs, and data mapping, build AI-enabled privacy workflows, monitor evolving regulations, and partner with Legal Ops to scale the program across jurisdictions while serving as a privacy

Responsibilities

• Support design and implementation of the global privacy program across GDPR, EU AI Act, NIS2, DORA, and US privacy laws.
• Drive AI governance execution with legal and privacy teams to meet EU AI Act obligations.
• Embed privacy by design in AI products, including model data governance and data-use analysis.
• Oversee privacy operations: DSARs, DPIAs, data mapping, retention, consent, and audits.
• Build AI-enabled privacy workflows and automation with Legal Ops and engineering.
• Monitor regulatory developments and advise on market-entry requirements.

Job description

About the Role

Abnormal AI is an AI-native cybersecurity company. We use behavioral AI to stop the attacks that get past everything else, and our products depend on processing data responsibly, at scale, across a growing set of global jurisdictions. We are looking for a Senior Privacy Counsel to own significant portions of our global privacy program — the legal judgment, the day-to-day operational execution and oversight, and the AI-enabled tooling that ties the two together.

This is a senior privacy role, reporting to and operating under the direction of the AGC, PPIP. You will advise product and engineering on building privacy into an AI-native platform, support AI governance from the legal and privacy side, provide product-privacy legal counseling alongside the Director, Legal (Product), and partner with the Privacy Manager, who handles much of the operational execution, to run the day-to-day privacy program (DSARs, assessments, ROPA, notices, audits). You will help build and operate the AI automation, working with Legal Ops and other internal teams, that makes the program scale, and serve as a privacy voice with customers via commercial legal.

We want someone with the expertise, drive, and assertiveness to own initiatives and drive them to completion with limited oversight — as comfortable writing a lawful-basis analysis as they are shipping a workflow that automates it.

Why Join Us

• Help build and scale the privacy function at a category-defining, AI-native cybersecurity company.
• Build, not just advise, with real license to design AI automation that changes how privacy work gets done.
• Work at the intersection of privacy, AI governance, product counseling, and security, on problems that are genuinely new.
• Competitive salary, benefits, and equity, and a clear path to grow the role toward greater program ownership as the program scales.

What You Will Do

• Global privacy program execution. Support the design of, and drive implementation and continuous improvement of Abnormal's global privacy program, partnering with applicable stakeholders on strategy, policies, standards, and controls, across GDPR/UK GDPR, EU AI Act, NIS2, DORA, EU Data Act, US state privacy laws, and other applicable international frameworks. Advise and execute on the international data transfer strategy (SCCs, UK IDTA, EU–US Data Privacy Framework, transfer impact assessments) as data flows and product footprint expand across jurisdictions.
• AI governance execution. Drive the day-to-day execution of the AI governance program from the legal and privacy side, including EU AI Act classification and related obligations, seeing initiatives through to completion in partnership with R&D, Security, and AI governance stakeholders.
• Privacy by Design for AI products and product counseling. Partner with the Privacy Manager and R&D to embed privacy into the design of new AI-driven features, including model data governance, secondary data-use analysis, and the privacy implications of behavioral AI. Set privacy diligence standards for AI/LLM vendors and model providers. Partner with the Director Legal, Product to provide ongoing product and privacy legal counseling to R&D for product and feature development.
• Privacy operations. Partner with the Privacy Manager to help oversee the privacy operations program — DSARs and data-subject rights, Records of Processing Activities and data mapping, impact assessments (DPIA/PIA/TIA/LIA), retention, consent and cookie management, and audit support (SOC 2, ISO 27701/42001). Contribute to privacy governance forums, as appropriate.
• Build and operate AI automation. Use AI to make the privacy program scale. Design, deploy, and improve AI-enabled privacy workflows (e.g., DPIA triage and drafting, subprocessor determination) with Legal Operations and engineering. A build-it role, not just a use-it one — specify, prototype, and iterate, holding tooling to a high accuracy and human-review bar.
• Legal & Regulatory Horizon Scanning. Monitors emerging legal and regulatory developments, including privacy and AI regulation, in current and target expansion markets; flagging jurisdiction-specific requirements to the AGC, PPIP to inform market entry or launch decisions, and translates confirmed guidance into execution support for R&D (product and privacy considerations) and GTM (contracting posture, customer requirements).
• Vendor,