Senior Privacy Counsel

Abnormal

7h•$199,800 - $235,000

About The Position

Abnormal AI is seeking a Senior Privacy Counsel to lead significant aspects of its global privacy program. This role involves legal judgment, operational execution, and the use of AI-enabled tooling. The position reports to the AGC, PPIP and will advise product and engineering teams on privacy integration within an AI-native platform, support AI governance, provide product-privacy legal counseling, and partner with the Privacy Manager on daily privacy program operations. The role also involves building and operating AI automation for program scalability and representing privacy interests to customers through commercial legal agreements. The ideal candidate is an expert, driven, and assertive individual capable of owning initiatives with limited oversight, comfortable with both legal analysis and automating processes.

Requirements

J.D. from an accredited law school and member in good standing of at least one U.S. state bar.
CIPP/E, CIPP/US certifications.
6-8+ years of relevant experience, with strong depth in privacy and data protection law and program execution.
Deep, current expertise in European privacy and digital regulation — GDPR/UK GDPR and working familiarity with NIS2, DORA, the EU AI Act, and the EU Data Act — and how they interact for an AI company.
Demonstrated experience operating in or advising technology companies, ideally in cybersecurity, SaaS, or cloud, including AI/ML products.
Meaningful experience contributing to and helping run a privacy program (beyond pure advisory work) in a fast-moving, global environment.
Experience providing product legal counseling alongside privacy.
Pragmatic judgment; ability to start from business objectives and find compliant paths, offering options and conditions rather than a reflexive 'no'.
Strong drafting and judgment on complex privacy agreements (DPAs, SCCs, subprocessor terms), and the ability to set positions, act as an escalation point for negotiation teams, and flag novel issues.
Sound judgment applied to significant, novel, and ambiguous issues, with accountability for outcomes and escalating direction calls as appropriate.
The drive and assertiveness to own initiatives and drive them to completion with minimal oversight.
Ability to lead through influence, including persuading diverse senior stakeholders.
Excellent communication and presentation skills, with the ability to explain complex privacy issues to business stakeholders.
Fluency with AI tooling and the ability to build and iterate on automation workflows — experience using AI for real work and ability to specify, prototype, and refine it, holding it to a high accuracy and human-review standard.

Nice To Haves

Experience supporting a DPO, including familiarity with independence and governance expectations.
Familiarity with privacy and data protection regimes beyond the EU/US — e.g., LGPD (Brazil), PIPEDA (Canada), APPI (Japan).
Experience supporting Works Councils and multi-jurisdiction employee/candidate privacy.
Experience with privacy tooling and with AI/LLM-based workflow automation.
Familiarity with security and privacy audit frameworks (SOC 2, ISO 27001/27701/42001).
CIPM, CIPT, AIGP certifications.

Responsibilities

Support the design, drive implementation, and ensure continuous improvement of Abnormal's global privacy program, partnering with stakeholders on strategy, policies, standards, and controls across various international frameworks (GDPR/UK GDPR, EU AI Act, NIS2, DORA, EU Data Act, US state privacy laws).
Advise on and execute international data transfer strategies (SCCs, UK IDTA, EU–US Data Privacy Framework, transfer impact assessments) as data flows and product footprint expand.
Drive the day-to-day execution of the AI governance program from a legal and privacy perspective, including EU AI Act classification and related obligations, in partnership with R&D, Security, and AI governance stakeholders.
Embed privacy into the design of new AI-driven features, including model data governance, secondary data-use analysis, and the privacy implications of behavioral AI, by partnering with the Privacy Manager and R&D.
Set privacy diligence standards for AI/LLM vendors and model providers.
Provide ongoing product and privacy legal counseling to R&D for product and feature development, in partnership with the Director Legal, Product.
Oversee the privacy operations program, including DSARs, Records of Processing Activities, data mapping, impact assessments (DPIA/PIA/TIA/LIA), retention, consent and cookie management, and audit support (SOC 2, ISO 27701/42001), by partnering with the Privacy Manager.
Contribute to privacy governance forums.
Design, deploy, and improve AI-enabled privacy workflows (e.g., DPIA triage and drafting, subprocessor determination) with Legal Operations and engineering.
Monitor emerging legal and regulatory developments in privacy and AI in current and target expansion markets, flagging jurisdiction-specific requirements to inform market entry or launch decisions.
Translate confirmed guidance into execution support for R&D and GTM teams.
Serve as the privacy subject matter escalation point for Commercial and Procurement teams on vendor, subprocessor, and customer agreements (DPAs, SCCs, subprocessor terms).
Partner with the AGC, PPIP to set privacy positions and playbooks for commercial teams.
Advise on and help lead the privacy and legal aspects of incident response, including AI incidents, breach assessment, notification decisions, and mitigation.
Support the DPO function as a day-to-day advisor, conducting first-line assessments, and support delegate-level assessments.
Serve as a privacy contact for supervisory-authority inquiries, customer privacy audits, and security questionnaires.
Track developments across the privacy and adjacent-regulatory landscape and translate regulatory change into concrete program action decisions.