Senior Legal Counsel – Cybersecurity, Privacy

Thomson Reuters

. Serve as the primary legal advisor at the intersection of cybersecurity and privacy law .

Posted 10/19/2026full-timeUnited StatesSenior💰 $119,700 - $222,300 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity and privacy law, with a strong focus on incident response, regulatory compliance, and risk management. Proficient in advising on data breach protocols and engaging with regulators while maintaining effective communication across cross-functional teams.

Highest-signal resume keywords

J.D. And Active Bar Membership8+ Years Experience In Privacy And Cybersecurity LawExpertise In GDPR And EU Cybersecurity RegulationStrong Knowledge Of US Privacy Laws And Breach Notification StatutesExperience With FedRAMP And NIST Security Frameworks

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseData Breach ManagementPrivacy Risk AssessmentsSecurity Control AssessmentsRegulatory ComplianceCybersecurity LawBreach NotificationPrivacy By DesignContract NegotiationCross-Border Data Flow Management

Soft Skills

Calm Under PressureDecisive LeadershipCross-Functional CollaborationEffective CommunicationStakeholder Engagement

Tools & Technologies

OneTrustPrivacy Operations PlatformsNIST Cybersecurity FrameworkISO 27001SOC 2

Certifications & Qualifications

CIPP/USCIPP/ECIPMCIPT

Industry Keywords

CybersecurityPrivacy LawRegulatory EngagementBreach Notification RequirementsFederal Security FrameworksAPAC Cybersecurity RegimesLATAM Data ProtectionEU Cybersecurity RegulationsNIS2DORA

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Serve as the primary legal advisor at the intersection of cybersecurity and privacy law
Advise on incident response, breach notification, regulatory engagement, security program requirements, security control assessments, and privacy and regulatory implications of products, cybersecurity architecture, and third-party risk management
Lead legal analysis during security incidents and data breaches, including triage, containment, notification obligations, and regulator and customer communication strategy
Coordinate with Information Security, IT, Risk, Communications, and outside counsel
Engage directly with U.S. state Attorneys General and other regulators on notifications, inquiries, and investigations
Develop and maintain global incident response and breach notification playbooks
Advise on US state, federal, EU, APAC, LATAM, and EMEA cybersecurity, privacy, and breach requirements
Monitor evolving global cybersecurity, breach notification, and privacy regulations and translate changes into practical guidance
Advise on FedRAMP, CMMC, HIPAA, the Privacy Act, and federal incident reporting
Support security control assessments against NIST 800-53 Rev 5, NIST 800-171, and FISMA
Turn security gaps into engineering-ready remediation plans with control ownership, acceptance criteria, and release-cycle sequencing
Support FedRAMP and other federal authorization packages, including SSP control narratives and POA&M management
Conduct product privacy and security gap assessments and validate post-implementation mitigations
Lead or oversee PIAs and DPIAs for high-risk processing and government-facing systems
Advise product and engineering teams on privacy- and security-by-design, including emerging AI and data regulation
Negotiate cybersecurity provisions in vendor and customer contracts
Advise commercial legal on NIS2 supply-chain, DORA ICT third-party, and Cyber Resilience Act obligations
Use OneTrust to manage incident tracking, risk assessments, PIAs/DPIAs, and regulatory reporting
Deliver executive-level reporting on legal risk, incident trends, and compliance status
Maintain playbooks, templates, and training
Report to the Chief Privacy Officer and collaborate with Information Security, Risk Management, Privacy Operations, and Commercial Legal

Requirements

What you’ll need

J.D. and active bar membership in at least one US jurisdiction, in good standing
8+ years of experience practicing privacy and/or cybersecurity law
Substantive experience advising on data breach response and incident management, including direct engagement with regulators such as state Attorneys General
Strong working knowledge of US privacy and cybersecurity law, including state breach notification statutes and CCPA/CPRA
Expertise in EU cybersecurity regulation, including GDPR security and breach requirements, NIS2, DORA, and the Cyber Resilience Act
Working knowledge of federal security frameworks such as FedRAMP, NIST 800-53/800-171
Experience supporting security control assessments or authorization packages
Experience conducting or overseeing privacy risk assessments, including PIAs and DPIAs
Ability to operate calmly and decisively under time pressure and lead cross-functional stakeholders through high-stakes incidents
Preferred: CIPP/US, CIPP/E, CIPM, or CIPT certification
Preferred: Working knowledge of APAC breach and cybersecurity regimes, including Singapore PDPA, Australia NDB scheme, and Japan APPI
Preferred: Experience advising a global organization with complex cross-border data flows
Preferred: Experience with FedRAMP continuous monitoring, HIPAA, or CMMC
Preferred: Hands-on experience with OneTrust or comparable privacy operations platforms
Preferred: Familiarity with SOC 2, ISO 27001, or the NIST Cybersecurity Framework
Preferred: Prior experience advising commercial or sales legal teams on cybersecurity-driven contract terms
Preferred: Experience with LATAM privacy and data protection regimes

Benefits

Comp & perks

Flexible hybrid working environment
Work from anywhere for up to 8 weeks per year
Flexible vacation
Two company-wide Mental Health Days off
Headspace app access
Retirement savings
Tuition reimbursement
Employee incentive programs
Mental, physical, and financial wellbeing resources
Two paid volunteer days off annually
Pro-bono consulting project opportunities
Environmental, Social, and Governance (ESG) initiatives
Health insurance
Dental insurance
Vision insurance
Disability insurance
Life insurance
401(k) plan with company match
Sick and safe paid time off
Paid holidays
Parental leave
Sabbatical leave
Optional hospital, accident and sickness insurance
Optional life and AD&D insurance
Flexible Spending Accounts
Health Savings Accounts
Fitness reimbursement
Employee Assistance Program
Group Legal Identity Theft Protection benefit
529 Plan access
Commuter benefits
Adoption & Surrogacy Assistance
Employee Stock Purchase Plan
Annual Bonus based on enterprise and individual performance (role may be eligible)