Senior Counsel - Data Governance, Privacy and Cybersecurity

Cencora • USA > PA > Remote, PA

2d • $119,100 - $186,560

About The Position

Cencora is seeking a Corporate Counsel II (Senior Counsel) to provide strategic legal leadership on data governance, privacy, cybersecurity, and AI for its Managed Services Organization (MSO), which serves retinal clinical practice groups across the United States. The position reports to the Assistant General Counsel, Privacy, Responsible Data, & Technology, and serves as a key legal resource to MSO legal and business teams on the design, launch, and operation of technology-based services involving sensitive health information and other regulated data.

The attorney will collaborate with medical professional teams, clinical operations, product and technology experts, information security, compliance, and commercial teams to enable MSO offerings while managing risk in a regulated healthcare environment. The role provides business-oriented legal advice and project management across MSO initiatives, including privacy- and security-by-design reviews, analysis of research protocols, data-sharing and interoperability arrangements, AI projects and governance, and incident-response readiness and mitigation.

The role requires a law degree from an accredited law school and admission to a U.S. state bar, along with 4–8 years of experience as a lawyer and expertise in privacy, cybersecurity, and/or data governance. The attorney is expected to handle sophisticated legal analysis and provide clear implementation guidance with minimal supervision in a fast-paced, risk-prioritized environment.

Requirements

• Law degree from an accredited law school.
• Admission to a U.S. state bar.
• 4–8 years of experience as a lawyer, with expertise in privacy, cybersecurity, and/or data governance.
• Working familiarity with cybersecurity and privacy regulations and frameworks relevant to MSO operations, including HIPAA/HITECH, state privacy laws (including consumer health privacy laws as applicable), SEC cybersecurity disclosure rules as applicable, AI regulatory frameworks, and security standards such as NIST CSF/800-53.
• Knowledge of healthcare business and industry models, practices, and trends, and ability to learn the competitive landscape quickly.
• Strong decision-making and ability to communicate business-oriented, legally compliant recommendations.
• Ability to solve straightforward and complex problems and reconsider potentially inefficient existing solutions.
• Ability to manage multiple matters, multitask, prioritize deliverables, and complete work in a timely and efficient manner.
• Willingness to adapt to change and shifting priorities, sometimes with minimal advance warning or direction.
• Effective oral and written communication skills.
• Strong collaboration and interpersonal skills, including the ability to work with colleagues at all levels.
• Effective negotiation and presentation skills, organizational savvy, creativity, and legal trend-spotting ability.
• Attention to detail and ability to learn nuances of technologies and approaches affecting the MSO and clinical space, particularly in data insights.
• Proficiency in Microsoft Word, Excel, PowerPoint, Teams, SharePoint, and the AI capabilities associated with this suite of tools.
• Ability to complete sophisticated, nuanced legal analysis and provide clear implementation guidance with minimal supervision in a fast-paced, risk-prioritized environment.

Responsibilities

• Advise on MSO data governance, privacy, AI, and cybersecurity matters, including data flows and operating models; use and protection of PHI and other sensitive data; and applicable U.S. federal and state privacy and security requirements.
• Counsel MSO business owners on privacy, security, and AI requirements for new and existing offerings, including platforms, analytics, care and therapy services support, population health insights, and other data-enabled services.
• Draft, review, and negotiate MSO-facing privacy and security contract terms, including BAAs, DPAs, data-sharing agreements, service agreements, and vendor or partner security addenda.
• Advise on third-party risk management, subcontractor flow-downs, and MSO client requirements.
• Partner with MSO information security and technology teams on security program needs, including NIST-aligned controls and HITRUST or ISO considerations where required.
• Support MSO incident-response preparedness and provide legal support, including advice on breach assessment and notification obligations.
• Coordinate with privacy, security, compliance, communications, and client teams on incident-related MSO client, patient, and regulatory communications.
• Support MSO governance and reporting, and assist with responses to client audits, questionnaires, and regulatory inquiries concerning privacy and cybersecurity representations.
• Build relationships and clear escalation paths with MSO clinical, medical, operations, product, engineering, security, compliance, commercial, legal, and other stakeholder teams to promote consistent and scalable data governance, privacy, and security risk management and enable data innovation.
• Conduct privacy-by-design and security-by-design reviews; analyze prospective and retrospective research protocols from privacy and technology law perspectives; review and enable data-sharing and interoperability arrangements; evaluate and advance AI projects and governance; and support incident-response readiness and mitigation.

Benefits

• Medical, dental, and vision care.
• Support for working families, which may include backup dependent care, adoption assistance, infertility coverage, family building support, behavioral health solutions, paid parental leave, and paid caregiver leave.
• Training programs and professional development resources.
• Mentorship programs.
• Employee resource groups.
• Volunteer activities.
• Resources supporting physical, emotional, financial, and social wellness.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: Ph.D. or professional degree