Privacy & Product Counsel
Build and run Hilbert's privacy program from within the product for its agentic AI growth platform. Advise on privacy-by-design for agentic workflows, ensure multi-jurisdictional compliance (US, UK, EU), negotiate enterprise DPAs/contracts, and serve as primary legal contact for customers. Requires 6-7 years PQE in privacy/product counsel at data/AI companies.
About the job
Responsibilities
- Design, build, and run Hilbert's privacy program end-to-end — policies, data mapping, retention, and vendor/subprocessor management — covering US and UK/EU entities and data flows.
- Advise product and engineering on privacy-by-design for agentic workflows: what data an agent can access, retain, infer, or act on, and how that's documented and defensible.
- Own compliance posture across CCPA/CPRA, US state privacy laws, UK GDPR/DPA 2018, and EU GDPR; track developing AI-specific rules.
- Build and maintain data processing agreements, international data transfer mechanisms (SCCs, UK IDTA/Addendum), and scalable subprocessor frameworks.
- Review and negotiate enterprise customer contracts, DPAs, and security addenda across US and UK/EU counterparties, working with sales.
- Advise product on building, marketing, and disclosing new agentic features, including human-in-the-loop requirements.
- Partner with security on incident response, breach notification, and customer-facing security representations.
- Serve as primary point of contact for enterprise customers' legal, security, and procurement teams regarding how Hilbert's AI handles their data.
- Act as generalist backstop for other legal questions.
Requirements
- 6–7 years of post-qualification experience (PQE) in privacy and product/commercial counsel.
- Experience split between in-house work at a data-intensive or AI company and enterprise contract negotiation.
- Genuine fluency across US, UK, and EU privacy law (CCPA/CPRA and state patchwork, UK GDPR/DPA 2018, EU GDPR).
- Product-oriented mindset: prefer shaping data flows in design reviews before build.
- Direct experience negotiating enterprise DPAs, security addenda, and cross-border transfer mechanisms.
- Strong generalist who communicates with clarity and conviction to founders, engineers, and enterprise counsel.
- High ownership and ability to operate in high-autonomy, high-ambiguity startup environment.
- Ability to move at startup speed without heavy process.
Nice-to-Haves
- Experience with agentic AI systems or data-intensive AI platforms.
- Familiarity with emerging state, federal, UK, and EU AI regulations.
Skills
Privacy Law, GDPR, CCPA, Cpra, Data Processing Agreements, International Data Transfers, Sccs, Uk Idta, Enterprise Contract Negotiation, Privacy By Design, Ai Compliance
Similar jobs
Legal jobs
Forus
New York, NY
Senior legal counsel will advise healthcare and clinical-operations stakeholders, lead commercial contracting, and own privacy, HIPAA, and healthcare compliance matters. The role requires 6+ years of legal experience, a J.D., U.S. bar membership, and strong commercial and regulatory expertise.
Firecrawl
San Francisco, CA
Owns commercial and product legal work, including technology negotiations, data licensing, AI, privacy, and intellectual-property counseling. The role requires 5–8 years of sophisticated experience, strong independent judgment, U.S. bar membership, and practical AI fluency.
Anthropic
San Francisco, CALeads Anthropic’s global economic sanctions compliance program, overseeing strategy, risk governance, screening controls, regulatory matters, export-controls coordination, and team development. Requires 10+ years of sanctions compliance experience, senior leadership reporting, and working knowledge of US export controls.
Kraken
United Kingdom
Advise Kraken’s UK business on cryptoasset, e-money, and payment-services regulation, licensing, and regulator relationships. Requires an England and Wales-qualified lawyer with at least six years of post-qualification financial-services regulatory experience and substantial FCA, cryptoasset, and payments expertise.
Anthropic
San Francisco, CAResearch Counsel advises AI research and data teams on copyright, privacy, licensing, regulatory, and research-governance issues across the model lifecycle. The role requires a JD, U.S. state bar membership, strong technical fluency, and at least eight years of relevant legal experience.