Director, Legal (Cybersecurity)

Nscale•San Francisco, CA

9d•$210,000 - $340,000•Remote

About The Position

We're looking for a U.S.-based Director, Legal (Cybersecurity) to serve as Nscale's lead cybersecurity counsel as we scale into a publicly listed global AI infrastructure company. Reporting to the General Counsel and SVP, Commercial Partnerships, you'll be the primary legal partner to our CISO and Security organization. You'll also work closely with AI infrastructure, data center operations, engineering, commercial legal, procurement, privacy, finance, and the executive team. This role is critical to building trust with customers, regulators, and investors. You'll own the legal strategy for incident response and cyber disclosure and help embed security-by-design across our cloud and data center footprint. You'll help shape how Nscale meets the security expectations of hyperscalers, AI labs, enterprises, regulated industries, and the public sector. You'll be a pragmatic, commercially minded leader who can move from the war room to the boardroom with equal credibility.

Requirements

U.S.-qualified attorney with 10+ years of experience, including significant in-house experience as cybersecurity or security counsel, preferably at a hyperscaler, cloud provider, AI lab, or high-growth tech company. Exceptional private practice candidates will also be considered.
Proven track record leading legal response to significant security incidents, including privileged investigations, notifications, and regulator engagement.
Working knowledge of SEC cybersecurity disclosure requirements and public company governance.
Strong familiarity with U.S. federal and state cyber and data security laws, and with international regimes such as NIS2, DORA, and UK and EU GDPR security obligations.
A trusted partner to CISOs and security engineers, able to understand technical controls and translate risk into clear business decisions.
Able to act as an independent legal voice while remaining an embedded partner to Security.
Litigation or investigations experience is a strong plus.
Calm, sound judgment under pressure, with a high degree of discretion.
Excellent communicator who can influence at all levels, including executives and the Board.
Comfortable operating with ambiguity in a fast-paced, high-growth environment.

Nice To Haves

Experience with critical infrastructure, data centers, or public sector security (FedRAMP, CMMC, DFARS)
Professional certifications such as CIPP/US, CISSP, or equivalent
Pre- or post-IPO company experience
Familiarity with AI and model security issues

Responsibilities

Serve as the CISO's closest legal partner, advising the Security team on security programs, policies, controls, and risk decisions.
Lead and manage external counsel as a hands-on, player-coach leader.
Build and lead Nscale's cybersecurity legal and regulatory compliance program across the U.S., and support execution in the UK, EU, and other regions.
Advise on the legal side of security frameworks and certifications, including SOC 2, ISO 27001, NIST CSF, FedRAMP, and CMMC.
Support Board, Audit Committee, and executive reporting on cyber risk and governance.
Lead legal strategy for security incidents and investigations, including directing privileged investigations, engaging forensic firms and outside counsel, and coordinating with law enforcement.
Own breach notification analysis and execution across U.S. state, federal, and international regimes, and customer contractual obligations.
Partner with Finance, Securities counsel, and Investor Relations on SEC cybersecurity disclosure obligations, covering materiality assessments, Form 8-K reporting, and annual 10-K governance disclosures.
Design and run incident response playbooks and executive tabletop exercises, and maintain a response posture ready for ransomware and extortion events.
Monitor and advise on the evolving cyber regulatory landscape, including CIRCIA, SEC rules, FTC and state enforcement, NIS2, DORA, and UK cyber resilience legislation.
Advise on security obligations tied to critical infrastructure, data centers, and public sector and regulated-industry customers.
Manage regulatory enquiries and engagement with cyber and data regulators.
Partner with commercial legal and procurement on security terms in customer and supplier contracts, including security addenda, audit rights, incident notification, liability, and SLAs.
Lead security due diligence and contractual controls across the supply chain, including hardware, software, and colocation partners.
Advise on cyber insurance coverage, claims, and renewals.
Support M&A, investor diligence, and strategic partnerships as the cybersecurity subject matter expert.
Advise on vulnerability disclosure, bug bounty, threat intelligence sharing, and security research programs.
Partner with the Privacy & AI team on data protection, AI security, and model and data security issues.
Build security-legal awareness across the business, and scale guidance through playbooks and training.