Legal Counsel- Regulatory Compliance

Abnormal · Remote, United States

We use behavioral AI to stop the attacks that get past everything else, and our products depend on processing data responsibly, at scale, across a growing set of global jurisdictions. We are looking for a Senior Privacy Counsel to own significant portions of our global privacy program — the legal judgment, the day-to-day operational execution and oversight, and the AI-enabled tooling that ties the two together.
You will advise product and engineering on building privacy into an AI-native platform, support AI governance from the legal and privacy side, provide product-privacy legal counseling alongside the Director, Legal (Product), and partner with the Privacy Manager, who handles much of the operational execution, to run the day-to-day privacy program (DSARs, assessments, ROPA, notices, audits). You will help build and operate the AI automation, working with Legal Ops and other internal teams, that makes the program scale, and serve as a privacy voice with customers via commercial legal.
We want someone with the expertise, drive, and assertiveness to own initiatives and drive them to completion with limited oversight — as comfortable writing a lawful-basis analysis as they are shipping a workflow that automates it.
Help build and scale the privacy function at a category-defining, AI-native cybersecurity company.
Competitive salary, benefits, and equity, and a clear path to grow the role toward greater program ownership as the program scales.
Support the design of, and drive implementation and continuous improvement of Abnormals global privacy program, partnering with applicable stakeholders on strategy, policies, standards, and controls, across GDPR/UK GDPR, EU AI Act, NIS2, DORA, EU Data Act, US state privacy laws, and other applicable international frameworks. Advise and execute on the international data transfer strategy (SCCs, UK IDTA, EU–US Data Privacy Framework, transfer impact assessments) as data flows and product footprint expand across jurisdictions.
Drive the day-to-day execution of the AI governance program from the legal and privacy side, including EU AI Act classification and related obligations, seeing initiatives through to completion in partnership with R&D, Security, and AI governance stakeholders.
Partner with the Privacy Manager and R&D to embed privacy into the design of new AI-driven features, including model data governance, secondary data-use analysis, and the privacy implications of behavioral AI. Partner with the Director Legal, Product to provide ongoing product and privacy legal counseling to R&D for product and feature development.
Privacy operations.

Partner with the Privacy Manager to help oversee the privacy operations program — DSARs and data-subject rights, Records of Processing Activities and data mapping, impact assessments (DPIA/PIA/TIA/LIA), retention, consent and cookie management, and audit support (SOC 2, ISO 27701/42001). DPIA triage and drafting, subprocessor determination) with Legal Operations and engineering. Legal & Regulatory Horizon Scanning.

Monitors emerging legal and regulatory developments, including privacy and AI regulation, in current and target expansion markets; flagging jurisdiction-specific requirements to the AGC, PPIP to inform market entry or launch decisions, and translates confirmed guidance into execution support for R&D (product and privacy considerations) and GTM (contracting posture, customer requirements).
Vendor, subprocessor, and customer contracts (escalation point).

Serve as the privacy subject matter escalation point for the Commercial and Procurement teams on vendor, subprocessor, and customer agreements (DPAs, SCCs, subprocessor terms). Advise on and help lead the privacy and legal aspects of incident response, including AI incidents, breach assessment, notification decisions, and mitigation, working within the companys procedures and regulatory deadlines.
Data Protection Officer support & regulatory engagement.

Serve as a privacy contact for supervisory-authority inquiries, customer privacy audits, and security questionnaires. Track developments across the privacy and adjacent-regulatory landscape (e.g., NIS2, DORA, and EU Data Act), and translate regulatory change into concrete program action decisions.
D. from an accredited law school and member in good standing of at least one U.6-8+ years of relevant experience, with strong depth in privacy and data protection law and program execution.
~ Deep, current expertise in European privacy and digital regulation — GDPR/UK GDPR and working familiarity with NIS2, DORA, the EU AI Act, and the EU Data Act — and how they interact for an AI company.
~ Demonstrated experience operating in or advising technology companies, ideally in cybersecurity, SaaS, or cloud, including AI/ML products.
~ Meaningful experience contributing to and helping run a privacy program (beyond pure advisory work) in a fast-moving, global environment.
~ Experience providing product legal counseling alongside privacy.
~ Strong drafting and judgment on complex privacy agreements (DPAs, SCCs, subprocessor terms), and the ability to set positions, act as an escalation point for the teams who negotiate them, and flag novel issues for escalation.
~ Familiarity with privacy and data protection regimes beyond the EU/US — e.g., In addition to base salary, this role may be eligible for bonus or incentive compensation, equity, and a comprehensive benefits package.
Abnormal AI uses AI-assisted tools to help our recruiting team prepare for candidate interviews. These tools analyze resume content and role requirements to suggest interview questions and areas for the interviewer to explore.Further, if your application is successful and Abnormal AI makes a conditional offer of employment, we will carry out pre-employment checks which must be successfully completed to progress to a final offer. All processes and pre-employment checks are in line with prevailing legislation and Abnormal AIs policies relevant to our security and privacy standards.
Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, protected veteran status or other characteristics protected by law. For our EEO policy statement please

click here

. If you would like more information on your EEO rights under the law, please

click here

.