Sr. Associate General Counsel, Cyber Security and Privacy - Remote

UnitedHealth Group•Minneapolis, MN

19d•Remote

About The Position

UnitedHealth Group is a health care and well-being company that’s dedicated to improving the health outcomes of millions around the world. We are comprised of two distinct and complementary businesses, UnitedHealthcare and Optum, working to build a better health system for all. Here, your contributions matter as they will help transform health care for years to come. Make an impact with a team that shares your passion for helping others. Join us to start Caring. Connecting. Growing together. The Sr. Associate General Counsel – Cyber Security & Privacy will support the Deputy General Counsel (DGC) for Cyber Security & Privacy in providing high quality, pragmatic legal counsel on a broad range of cybersecurity, privacy, and data protection matters. This position will be the front -line lead attorney on cyber security events. Additionally, this role will provide substantive legal analysis, issue spotting, and operational guidance and will partner closely with the Enterprise Privacy Office (EPO), Enterprise Security & Resiliency Office (ESRO), Technology, Human Resources, and other cross functional stakeholders to help the organization meet rapidly evolving privacy and cybersecurity regulatory requirements. You’ll enjoy the flexibility to work remotely from anywhere within the U.S. as you take on some tough challenges. For all hires in the Minneapolis or Washington, D.C. area, you will be required to work in the office a minimum of four days per week.

Requirements

8+ years of experience in privacy, cybersecurity, data protection, or related regulatory legal practice
Experience with HIPPA security rule
Solid understanding of U.S. federal and state privacy/security frameworks (e.g., HIPAA, state breach notification laws) and ability to analyze complex legal issues and provide actionable guidance
Demonstrated ability to lead and run a cyber investigation/breach
Demonstrated ability to work effectively across a large, matrixed organization

Nice To Haves

Experience advising on cybersecurity regulatory frameworks (e.g., NYDFS, SEC cybersecurity regulations)
Experience supporting large scale healthcare, insurance, technology, or security operations
Experience supporting enterprise privacy/security programs within a regulated industry
Familiarity with global privacy regulations (e.g., GDPR, APAC privacy laws)
Proven solid drafting, communication, and cross functional partnership skills

Responsibilities

Analyze and advise on legal obligations related to UnitedHealth Group’s handling of personal and confidential information, including HIPAA, state privacy laws, U.S. federal privacy/security laws, and emerging global privacy regulations
Support compliance efforts related to cybersecurity, privacy, and data security frameworks and regulations (e.g., NYDFS)
Stay apprised of changing state/federal laws and requirements and develop practical recommendations on privacy/security requirements for business operations, vendor engagements, and product development
Assist with drafting, updating, and operationalizing privacy, cybersecurity, and data protection policies, procedures, standards, and guidelines
Lead and run a cyber event and investigation from discovery through investigation/forensics to fulfillment of state and federal notice requirements
Support the DGC in cyber incident preparedness and response, including participating in tabletop exercises and reviewing incident assessments
Assist in evaluating incidents involving personal or confidential data, privacy/security investigations, and regulatory reporting obligations
Monitor, interpret, and assist with implementation of new and emerging privacy, cybersecurity, and data protection laws
Review and advise on IT development, acquisition, and data architecture matters (e.g., data localization, cross border transfers)
Support legal analysis for insider risk and Red Flags program requirements
Partner with ESRO teams, Technology, Corporate Security, Communications, and other legal partners to deliver coordinated, well reasoned guidance
Assist business leaders in understanding privacy and cybersecurity risks and recommended mitigations
Provide consultative legal support to help business teams operate in compliance with privacy and cybersecurity expectations
Develop and deliver legal training related to privacy, cybersecurity, data protection, and information risk management
Support day to day operational legal needs arising within the Enterprise Privacy Office and ESRO
Assist with preparing materials and documentation for internal audits, stakeholder briefings, or regulatory inquiries