Privacy & Product Counsel

Responsibilities

• Design, build, and run Hilbert's privacy program end-to-end — policies, data mapping, retention, and vendor/subprocessor management — covering US and UK/EU entities and data flows.
• Advise product and engineering on privacy-by-design for agentic workflows: what data an agent can access, retain, infer, or act on, and how that's documented and defensible.
• Own compliance posture across CCPA/CPRA, US state privacy laws, UK GDPR/DPA 2018, and EU GDPR; track developing AI-specific rules.
• Build and maintain data processing agreements, international data transfer mechanisms (SCCs, UK IDTA/Addendum), and scalable subprocessor frameworks.
• Review and negotiate enterprise customer contracts, DPAs, and security addenda across US and UK/EU counterparties, working with sales.
• Advise product on building, marketing, and disclosing new agentic features, including human-in-the-loop requirements.
• Partner with security on incident response, breach notification, and customer-facing security representations.
• Serve as primary point of contact for enterprise customers' legal, security, and procurement teams regarding how Hilbert's AI handles their data.
• Act as generalist backstop for other legal questions.

Requirements

• 6–7 years of post-qualification experience (PQE) in privacy and product/commercial counsel.
• Experience split between in-house work at a data-intensive or AI company and enterprise contract negotiation.
• Genuine fluency across US, UK, and EU privacy law (CCPA/CPRA and state patchwork, UK GDPR/DPA 2018, EU GDPR).
• Product-oriented mindset: prefer shaping data flows in design reviews before build.
• Direct experience negotiating enterprise DPAs, security addenda, and cross-border transfer mechanisms.
• Strong generalist who communicates with clarity and conviction to founders, engineers, and enterprise counsel.
• High ownership and ability to operate in high-autonomy, high-ambiguity startup environment.
• Ability to move at startup speed without heavy process.

Nice-to-Haves

• Experience with agentic AI systems or data-intensive AI platforms.
• Familiarity with emerging state, federal, UK, and EU AI regulations.