Corp Counsel III (Privacy, Digital Risk, and Cybersecurity)

Premier Inc.

1d•$141,000 - $234,000•Remote

About The Position

Working as part of Premier’s Privacy Office, the Corporate Counsel III advises Premier on compliance with applicable privacy, cybersecurity, and digital laws, regulations, and industry frameworks, including U.S. state privacy laws, HIPAA and HITECH, PCI DSS, and NIST. The role is the team’s principal legal specialist for cybersecurity regulatory compliance and partners with the Corporate Counsel III (Privacy, Digital & AI) on privacy compliance and digital risk oversight. The attorney provides practical, risk-based guidance to business teams, the AI & Data Analytics organization, and Legal. The attorney partners across the organization to improve, operationalize, and evolve privacy, cybersecurity, and digital governance programs. Working closely with Security and Technology teams, the role translates regulatory requirements into practical, scalable processes and controls for supplier privacy and vendor cybersecurity assessments, privacy impact assessments, privacy-related cybersecurity audit requirements, online privacy and digital compliance, and specialized contract negotiations. The attorney monitors evolving legal requirements and advises stakeholders on their impact. The successful candidate is a proactive, business-minded attorney who enjoys building governance programs and processes, works independently and collaboratively, and provides clear recommendations. The role calls for effectiveness in a fast-paced, complex environment and collaboration with senior management, IT and cybersecurity teams, business teams, vendors, customers, and outside counsel. This is a remote position with 1–20% travel within the United States. The work is sedentary and includes remaining stationary for prolonged periods.

Requirements

At least 7 years of applicable work experience (required).
Juris Doctorate (required).
Active license in good standing to practice law in at least one U.S. jurisdiction, with eligibility to serve as in-house counsel as required.
Substantive knowledge of U.S. privacy and data protection laws, including HIPAA and HITECH, state comprehensive privacy laws, state consumer health data laws, data breach notification laws, and requirements governing personal information.
Experience interpreting cybersecurity laws, regulations, and frameworks such as FISMA, NIST, and PCI DSS, and translating requirements into practical guidance for cybersecurity, IT, compliance, and business teams.
Hands-on experience conducting or overseeing privacy and digital risk assessments, including privacy impact assessments, records of processing activities, data subject request workflows, supplier privacy reviews, vendor cybersecurity assessments, and assessments of new products, technologies, data uses, or business initiatives.
Experience advising on digital compliance, including privacy disclosures, online tracking technologies, cookies and consent, digital terms and conditions, consumer-facing data practices, and accessibility-related legal requirements.
Experience supporting privacy and cybersecurity incident response, including legal assessments, investigations, mitigation, notification obligations, notifications, and coordination with affected parties, regulators, vendors, and counsel.
Experience drafting, reviewing, and negotiating privacy, cybersecurity, and data protection provisions in commercial agreements, including data processing agreements, business associate agreements, cybersecurity addenda, incident notification provisions, international data transfer terms, and customer and supplier contract requirements.
Experience advising business, product, technology, data, and cybersecurity stakeholders on new products, services, systems, vendors, and data uses, identifying requirements early and recommending practical controls or mitigations.
Experience developing, implementing, or materially improving privacy, cybersecurity, or digital governance programs, including policies, standards, procedures, assessment methodologies, templates, decision records, escalation protocols, training materials, and compliance workflows.
Ability to remain stationary for prolonged periods, adapt and change priorities quickly, meet deadlines, pay attention to detail, operate computer programs and software, communicate effectively in person and electronically, interact with others, make independent decisions, and work collaboratively in close quarters with interruptions.

Nice To Haves

One or more relevant privacy or AI governance certifications, such as CIPP/US, CIPP/E, CIPM, or CIPT.
Experience operationalizing privacy, AI, and digital risk programs and related processes.
Familiarity with OneTrust, Transcend, or similar privacy or AI governance platforms.
At least 5 years of relevant legal experience, preferably 5–7 or more years, advising on privacy, cybersecurity, digital compliance, technology, or related regulatory matters in a law firm, in-house legal department, government agency, or comparable environment.

Responsibilities

Support compliance with applicable privacy and cybersecurity laws and industry frameworks, including monitoring and interpreting developing laws and frameworks.
Provide legal oversight and guidance on digital compliance risks, including website and application terms and conditions, online tracking technologies, digital accessibility, digital asset disclosures, and employee data access policies.
Incorporate privacy, cybersecurity, and digital compliance-by-design principles into enterprise innovation and growth initiatives.
Conduct enterprise legal risk reviews involving privacy, cybersecurity, and digital matters, including privacy impact assessments, data subject rights requests, supplier privacy reviews, and vendor cybersecurity assessments; support AI impact assessments involving these issues.
Contribute to modernization and development of the Digital & Data Legal and Governance organization, policies, procedures, and enterprise risk governance framework.
Provide legal counsel for security and privacy incident investigations, mitigation, response, and regulatory reporting in partnership with internal stakeholders and external parties.
Serve as a primary legal specialist to the AI & Data Analytics Office and Legal on privacy, cybersecurity, and digital regulatory compliance and risk.
Maintain related policies and contract templates, and draft and negotiate specialized or complex contract terms in these areas.