Director of Privacy & Cyber Legal Affairs

Xanterra Travel Collection•Greenwood Village, CO

1d•Onsite

About The Position

Join the Xanterra Travel Collection team: Xanterra Travel Collection is a premier group of travel and leisure businesses with a focus on sustainability and exceptional service. Headquartered in Greenwood Village, Colorado, we operate iconic properties and services in stunning locations worldwide, including lodging, food and beverage, Windstar Cruises, short-line railroads, and adventure travel. We are dedicated to creating unforgettable experiences for our guests and providing transformative career opportunities for our team members. We are seeking a dynamic and strategic Director, Privacy & Cyber Legal Affairs to join our team and lead our commercial, privacy, and cyber security guidance for Xanterra Travel Collection’s brand of companies (“Xanterra”). This is a new role that will oversee Xanterra’s privacy program, working closely with key business partners in IT and Commercial. Xanterra is growing its legal team to include a key role that will shape the future growth of the company in North America and Internationally. This position is located in Xanterra’s corporate offices in Greenwood Village, Colorado, will report to Xanterra’s Chief Legal Officer, and will work closely with Xanterra’s legal, IT, and Commercial teams to support overall privacy and cyber compliance.

Requirements

Demonstrated expertise in privacy and cybersecurity law is required.
J.D. degree and admission to practice law in at least one U.S. jurisdiction strongly preferred.
Industry-recognized privacy and security certifications, such as CIPP, CIPM, CIPT, CISSP, or CISM, are strongly preferred.
Additional graduate-level study or specialized training in privacy, data protection, information governance, cybersecurity, or artificial intelligence governance is a plus.
3+ years of legal or equivalent privacy-related experience, with a strong focus on privacy, cybersecurity, information security, or technology law.
Familiarity with widely accepted cybersecurity standards and frameworks, such as NIST’s Cybersecurity Framework or ISO 27002.
Solid understanding of privacy principles, frameworks and laws, with a focus on North American, United Kingdom and EU privacy law and regulations.
Experience negotiating cybersecurity and data governance terms in contracts with vendors and clients.
Experience advising on cybersecurity and privacy issues in complex, regulated environments is preferred.
Strong communication skills with the ability to translate technical issues into clear legal guidance and the ability to translate legal guidance into actionable requirements.
Proficient with Microsoft suite tools, including all tools within Office365.
Collaborative mindset and ability to work across diverse teams and cultures.
A proactive, solutions-oriented approach and willingness to challenge the status quo.
International legal and privacy experience is preferred.

Responsibilities

Be a key legal partner to our business teams, helping to shape secure, compliant, and innovative solutions across our platforms and services.
Provide strategic legal advice on cybersecurity laws, regulations, and frameworks (g., NIST, PCI-DSS, SOC 2, ISO 27001, DORA, NIS2), as well as advice on global privacy laws, with a focus on North America, the United Kingdom, and Europe.
Draft and refine cybersecurity and privacy policies, risk assessments, and governance frameworks.
Advise and support cyber-related incident response planning, breach notification obligations, and post-incident reviews.
Manage and oversee internal data privacy requests and adherence across the Company, partnering with IT and Commercial leadership.
Prepare and revise vendor agreements and addendums to ensure compliance with various Federal, State, and international laws.
Audit existing and legacy vendor agreements to update or insert appropriate data privacy protection for the Company.
Support cybersecurity and privacy -related aspects of contracts, including vendor risk, data security terms, and regulatory compliance.
Collaborate with business and product counsel to embed security-by-design and privacy-by-design principles across the enterprise.
Engage with regulators and industry bodies on privacy and cybersecurity initiatives and compliance matters.