Senior Privacy Counsel - AI Governance & Breach (Hybrid)

Nordstrom; Seattle (WA); Hybrid; USD 220,000 - 280,000; Full time

Job summary

Nordstrom in Seattle seeks a Senior Corporate Counsel, Privacy to own U.S. privacy strategy within a hybrid Seattle setting.

You will guide compliance across CCPA/CPRA, MHMDA and other state regimes, develop AI governance standards, and lead incident response for data breaches. The role sits at the intersection of Technology and Legal, partnering with InfoSec, Marketing, and Product to embed privacy into products and vendor agreements, while shaping a company-wide privacy program for a major

Qualifications

• J.D. with license to practice law in Washington.
• 7–10 years of legal experience with a meaningful focus on U.S. privacy law.
• In-house or law firm experience advising large complex organizations.
• Expertise in CCPA/CPRA, state privacy statutes, CAN-SPAM, TCPA, behavioral advertising, GLBA, HIPAA, PIPEDA.
• Familiarity with AI governance frameworks, EU AI Act, FTC guidance, WA MHMDA.
• Experience with data security incidents and breach notification.
• Strong drafting skills for policies, contracts, legal summaries.

Responsibilities

• Lead the U.S. privacy compliance program, including notices, consent, opt-out, and DSAR processes.
• Develop AI governance framework, vendor due diligence, and deployment standards.
• Provide legal counsel on breach response, incident management, and cross-state notifications.
• Draft privacy provisions in commercial/tech agreements and train stakeholders.

Skills

U.S. privacy law

CCPA/CPRA

Privacy policy drafting

AI governance familiarity

Breach response experience

Health data knowledge

Education

J.D. (Washington licensed)

Job description

Nordstrom in Seattle seeks a Senior Corporate Counsel, Privacy to own U.S. privacy strategy within a hybrid Seattle setting.

You will guide compliance across CCPA/CPRA, MHMDA and other state regimes, develop AI governance standards, and lead incident response for data breaches. The role sits at the intersection of Technology and Legal, partnering with InfoSec, Marketing, and Product to embed privacy into products and vendor agreements, while shaping a company-wide privacy program for a major