Director, Privacy Counsel

Location: Brisbane, California or Remote (Central/West Coast preferred)

Position Summary:

[Employer] [Employer] is seeking Privacy Counsel to join its legal team and report to the SVP, Deputy General Counsel. This role is the company's in-house privacy expert, responsible for addressing the full range of [Employer]'s privacy needs across clinical, commercial, corporate, and employee data, in the U.S. and globally.

The Privacy Counsel will serve as a trusted advisor to internal stakeholders across R&D, Clinical, Commercial, Compliance, IT, HR, and Finance. The role requires someone who can work independently, exercise sound judgment, and deliver clear, practical recommendations even when the facts are incomplete. The ideal candidate brings deep life sciences privacy experience, understands the handling of protected health information (PHI) and personally identifiable information (PII), and can balance risk mitigation with the business's need to move quickly. This is an opportunity to shape and build a privacy program at a growing biotech as it advances its pipeline and builds out its commercial operations.

Responsibilities:

• Own privacy legal strategy: Serve as the company's primary privacy counsel, advising on all privacy matters across clinical development, commercial operations, corporate functions and IT.
• Advise internal stakeholders: Provide timely, actionable guidance to business partners and leadership, including making clear recommendations when facts are incomplete and clearly communicating residual risk.
• Navigate U.S. and global privacy law: Advise on compliance with CCPA/CPRA, CIPA, HIPAA, FTC requirements, other state privacy and consumer health data laws, GDPR, the UK GDPR and Data Protection Act, and other international privacy regimes as [Employer]'s activities expand.
• Develop policies and procedures: Identify gaps in [Employer]’s privacy and data governance framework and independently draft, implement, and maintain the policies, procedures, and guidance needed to meet company and legal requirements, tailoring them to the needs of each business function.
• Address PHI and PII issues: Advise on the collection, use, storage, disclosure, and cross-border transfer of PHI and PII, including in clinical trials, patient support, commercial, and employee contexts.
• Manage vendor and third party privacy risk: Review and negotiate data protection terms, business associate agreements, data processing agreements, and international transfer mechanisms; support vendor privacy and security diligence.
• Build and maintain the privacy program: Develop and update privacy policies, notices, procedures, training, and records of processing; support data mapping, data protection impact assessments, and privacy by design in new initiatives.
• Respond to privacy events: Support the assessment of, response to, and notification obligations for privacy incidents and data security events, and handle data subject and consumer requests.
• Monitor the legal landscape: Track emerging privacy, health data, and AI related legal developments and translate them into practical guidance and program updates.
• Collaborate across the company: Partner with Compliance, IT, HR, Clinical, Commercial, and Finance to embed privacy into day to day operations and decision making, and work with outside counsel and consultants as needed.
• DPO/DPR Management: Manage all interactions with the company’s external DPO and DPRs globally.

Qualifications:

• Legal Expertise & Credentials: J.D. and licensed to practice law in good standing in at least one U.S. state, and authorized to practice in California as registered in-house counsel (if residing in California), with 8 to 10 years of legal experience focused on privacy, including law firm training and in-house experience.
• Life Sciences Experience (required): Demonstrated experience advising biotechnology, pharmaceutical, or other life sciences companies on privacy matters, including clinical research and commercial data practices.
• U.S. Privacy Law: Working knowledge of HIPAA, CCPA/CPRA, CIPA, and the growing body of state privacy and consumer health data laws.
• International Privacy Law: Working knowledge of GDPR, UK GDPR and the UK Data Protection Act, and cross-border data transfer requirements.
• PHI and PII Expertise: Familiarity with issues involving PHI and PII, including the transfer, collection, storage, and use of such data.
• Vendor Experience: Experience working with vendors on data protection terms, business associate and data processing agreements, and privacy and security diligence.
• Independent Judgment: Proven ability to work independently, make sound risk-based recommendations with incomplete information, and advise stakeholders at all levels, including senior leadership.
• Strategic & Pragmatic Thinker: Hands-on, pragmatic problem solver who can balance day to day requests with longer term program priorities.
• Interpersonal Excellence: Collaborative, intellectually curious, and an outstanding communicator who can explain complex privacy concepts clearly to non-lawyers and earn trust across the organization.
• Values-Driven & Mission-Focused: Committed to [Employer]'s values and motivated by the mission to advance patient care and improve outcomes for individuals with serious immunologic diseases.
• Process and Operational Excellence Mindset: Ability to build practical processes, drive continuous improvement, and use technology and data to scale a privacy program.

[Employer] [Employer] Inc. is an equal-opportunity employer.

[Employer] [Employer] is committed to fair and equitable compensation practices and we strive to provide employees with total compensation packages that are market competitive. The exact base pay offered for this role will depend on various factors, including but not limited to the candidate’s geography, qualifications, skills, and experience.

At [Employer], base pay is only one part of your total compensation package. The successful candidate will be eligible for an annual performance incentive bonus, new hire equity, and ongoing performance-based equity. [Employer] [Employer] also offers various benefits offerings, including, but not limited to, medical, dental, and vision insurance, 401k match, flexible time off, and a number of paid holidays.

Notice to Recruiters/Staffing Agencies

Recruiters and staffing agencies should not contact [Employer] [Employer] through this page. All recruitment vendors (search firms, recruitment agencies, and staffing companies) are prohibited from contacting our hiring manager(s), executive team members, or employees.

We require that all recruiters and staffing agencies have a fully executed, formal written agreement on file.

[Employer] [Employer]’ receipt or acceptance of an unsolicited resume submitted by a vendor organization to this website or employee does not constitute an actual or implied contract between [Employer] [Employer] and such organization and will be considered unsolicited and [Employer] [Employer] will not be responsible for related fees.

Fraud Alert

To all candidates: your personal information and online safety are a top priority for us. At [Employer] [Employer], recruiters only direct candidates to apply through our official career page at .

Recruiters will always contact you using the domain of veratx.com. We will never request payments, ask for financial account information or sensitive information like social security numbers. If you are unsure if a message is from [Employer] [Employer], please email human resources.

CA Privacy Notice

Applicants residing in California should review our California Privacy Notice for Employees, Job Applicants, and Contractors, which describes the categories of personal information we collect, how we use it, and your privacy rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act: .

Originally posted on [Employer]