Privacy Counsel - UK

Description

WHO WE ARE

Come join the company at the center of how the world adopts AI securely. Cyera’s mission is to give enterprises the confidence to embrace AI safely - deciding exactly what it can see and do as it reaches deeper into the business. We started by solving the hardest problem in data security: finding and securing data faster and more precisely than anyone thought possible. That foundation is now the essential AI trust infrastructure for the Fortune 1000. We’re hiring mission-driven talent to put those leaders at the center of our story.

THE OPPORTUNITY

As Privacy Counsel, you will be a hands-on member of Cyera's Legal team in London, playing a central part in the day-to-day operation of our global privacy program. You will work across product, business and security teams, covering GDPR, UK GDPR, CCPA/CPRA and the growing patchwork of state and international privacy laws.

This is an individual contributor role for a privacy lawyer with 4-5 years of experience who wants broad exposure and real ownership. You will operate the privacy practice: keeping the data inventory and records of processing current, running assessments, handling subprocessor and data subject request processes, updating internal policies and answering customer and privacy questions and setting Cyera’s privacy standards across vendors. We are a lean, fast-moving team, so your work will have an immediate impact and the room to grow is real. You will report and work closely with Cyera's Senior Legal Director and other Legal team members.

RESPONSIBILITIES:

Privacy program operations

• Work on privacy projects and take day-to-day responsibility for the maintenance of the data inventory and records of processing (RoPA), data flow documentation and retention schedules.
• Prepare, update and send privacy notices to the relevant audiences (customers, website visitors, employees and candidates) and work with the team to update privacy artifacts as needed.
• Help develop and update internal privacy policies, procedures and training for business and engineering teams.

Assessments and regulatory change

• Conduct and document privacy impact assessments (PIAs), data protection impact assessments (DPIAs) and transfer impact assessments (TIAs), and partner with Product and Engineering on privacy-by-design for new features, including AI-related functionality.
• Track privacy obligations across GDPR, UK GDPR, CCPA/CPRA and other US state and international privacy laws, and translate changes into control, policy or process updates.

Subprocessors, data subject requests and incidents

• Support the subprocessor onboarding, notification and disclosure process, working with Procurement, Security and the business to assess new vendors and keep the public subprocessor list current.
• Run data subject request (DSR) handling end to end, from intake and verification to response and records.
• Support privacy incident response in coordination with Legal and Security, including assessing notification obligations and documenting decisions.

Customer-facing privacy and GRC

• Serve as the GRC point of contact for customer and vendor privacy questionnaires and RFPs, including the external privacy sections of security questionnaires.
• Review and advise on data processing agreements (DPAs) and privacy terms with customers, partners and vendors, working with the commercial legal team.

Business partnership

• Provide timely and accurate advice to your legal team-members.
• Advise Product, Sales, Marketing, HR, IT and Security on privacy questions with practical, risk-based guidance that non-legal colleagues can act on.
• Escalate high-risk issues early and contribute to a unified, scalable approach to risk across the Legal function.

Requirements

REQUIRED QUALIFICATIONS:

• Qualified to practice law in England & Wales or another European jurisdiction, with 4-5 years of post-qualification experience advising on privacy and data protection.
• Solid working knowledge of GDPR and UK GDPR, and familiarity with CCPA/CPRA and other US state and international privacy laws, applied practically and commercially.
• Hands-on experience with privacy program operations: RoPA and data mapping, retention, privacy notices, and conducting PIAs, DPIAs and TIAs.
• Familiarity with SaaS, security products and related privacy issues.
• Experience with data subject requests, vendor and subprocessor reviews, and DPA review and negotiation.
• Ability to translate legal requirements into clear, actionable guidance and process changes for product, engineering and business teams.
• Strong organizational skills, with the ability to manage multiple projects and deadlines at once.
• Excellent written and verbal communication in English.
• A proactive, solution-oriented team player with sound judgment, comfortable owning work independently in a fast-paced environment.

Preferred Qualifications

• In-house experience at a technology, SaaS, data security or cloud company, with familiarity with cloud environments and data security concepts.
• Experience supporting customer security and privacy questionnaires, RFPs or trust and GRC functions.
• Exposure to AI governance and emerging regulation, including the EU AI Act.
• A privacy certification such as CIPP/E, CIPM or CIPT.
• Experience with privacy or contract management tooling, such as a privacy management platform or a CLM system.

COMPENSATION INFORMATION:

This compensation range represents Cyera’s good faith and reasonable estimate of the range of possible compensation for this role at the time of posting, and Cyera may ultimately pay more or less than the posted range. The final salary for this position will be determined in Cyera’s sole discretion, consistent with applicable law, and based on a variety of factors, including but not limited to the employee’s work experience, skills, and qualifications for the role, as well as the needs of Cyera’s business and other operational considerations.

Final compensation will vary based on seniority and relevance of experience, location, and position requirements.

This role may be eligible for potential merit increases based on factors such as individual or company performance, time in role, and other discretionary factors.

BENEFITS - Why Cyera?

• Hybrid working from our London base
• Competitive salary and equity
• Generous PTO, in line with statutory requirements
• Paid holidays and sick time, in accordance with local law
• Health, dental and vision insurance, or the applicable local equivalent
• Life and disability insurance, or the local equivalent, as applicable
• The opportunity to build and shape Cyera's privacy program at a company at the center of AI and data security