Privacy Counsel

Great American Insurance Company•Cincinnati, OH

1d•Hybrid

About The Position

The Company is seeking a practical, collaborative Privacy Attorney to join its legal and compliance team and support a broad portfolio of privacy, data protection, cybersecurity, emerging technology/AI, and regulatory matters. The attorney will partner with business, technology, information security, compliance, procurement, and legal stakeholders across a complex insurance organization to translate evolving legal requirements into clear, defensible, and operationally workable solutions and support the organization’s privacy program. This role is well suited for an attorney with four to five years of relevant experience, who has a background in privacy and data protection frameworks and is ready to take on meaningful responsibility in an in-house environment.

Requirements

Juris Doctor degree from an accredited law school.
Active license and good standing in at least one U.S. jurisdiction.
Generally, four to five years of relevant legal experience in privacy, health information, cybersecurity, technology, or related regulatory practice.
Experience with HIPAA a plus.

Nice To Haves

Experience in a law firm, advising on a variety of privacy, cybersecurity, and emerging technology matters.
Experience with insurance or financial services regulations.
Experience supporting privacy or security incident response and breach-notification analyses.
Privacy certification, such as CIPP/US, or a comparable credential.
Practical, curious, and comfortable learning complex business operations and technologies.
Collaborative, team oriented, and able to build credibility with legal, technical, operational, and executive stakeholders.
Clear and concise in communicating complex legal requirements to non-legal audiences.
Organized, responsive, and capable of advancing work independently while knowing when to escalate.
Committed to high-quality work, sound judgment, and continuous development in an evolving area of law.

Responsibilities

Support the development, implementation, and ongoing maturation of the Company’s privacy program, including policies, procedures, training, governance, and third-party contracting.
Support privacy and security incident response, including investigation, remediation, documentation, and individual and regulator notifications under applicable laws.
Draft, review, and negotiate privacy and data protection terms in commercial agreements, including data processing agreements, business associate agreements, and artificial intelligence provisions.
Support compliance with privacy and data security laws, such as the NYDFS Part 500, GLBA and related state insurance laws and regulations, CCPA/CPRA, HIPAA, GDPR, and other applicable regulatory frameworks.
Monitor legal and regulatory developments and translate them into practical recommendations, policies, controls, training, and implementation plans.
Develop trusted relationships with internal clients and deliver responsive, business-oriented legal guidance and workable compliance frameworks.