Senior Privacy Counsel, 2U

• 5-7 years of legal experience, with a focus on privacy / data protection
• J.D. and active membership and good standing in at least one State Bar
• CIPP / US certification preferred
• Strong academic credentials
• Ability to translate legal requirements into practical guidance for non-lawyers
• Co-operative, team-oriented
• In-house experience preferred

Desirable

• The Senior Privacy Counsel will sit within 2U’s dynamic legal team and will work hand-in-hand with the business units across our company
• They will report directly to our Chief Privacy Officer and will have a key leadership role in supporting 2U’s global privacy program
• The Senior Privacy Counsel will be responsible for defining, maintaining, and evaluating compliance with 2U’s privacy program and reporting and strategizing with executive leadership on initiatives of utmost importance to the company’s business strategy
• They will have a background in consumer protection, compliance, and risk management
• They will be responsible for establishing privacy compliance requirements that satisfy state, federal, and global privacy regulations, and for leading complex and critical projects related to the collection, processing, and retention of personal data
• They will work closely with technology and business stakeholders to create and maintain appropriate business records reflecting the products that support 2U’s privacy and data use infrastructure and serve as a resource on privacy, data protection, data flows, and related legal issues
• They will direct and coordinate activities necessary to complete major cross-functional projects to ensure compliance with data protection laws
• Legal subject matter expert on privacy / Providing legal advice and guidance to cross-functional business units across diverse subject areas, including privacy, consumer protection, and data security
• Privacy controls and protections / Developing privacy safeguards, standards and best practices for critical projects related to the collection, processing, and retention of personal data
• Data protection compliance / Managing data subject access requests, updating privacy notices and ensuring compliance with other consumer-facing data protection requirements
• Risk assessments / Conducting privacy risk assessments to identify and mitigate privacy risks
• Training and education / Creating and leading internal privacy trainings with stakeholders across the company
• Incident response / Handling privacy incident response, including risk mitigation and required legal analysis, for time-sensitive matters
• Privacy contractual provisions / Drafting and negotiating data processing and data usage agreements, including interfacing with University partners or vendors, where necessary
• Privacy documentation / Partnering with technology and business stakeholders to create and maintain artifacts documenting 2U’s privacy and data use infrastructure
• Be collaborative, inquisitive, and enthusiastic about technology and data
• Demonstrate strong analytical and organizational skills and the ability to work effectively in a fast-paced environment with minimal supervision and tackle complex legal issues that arise without advance notice
• Be self-motivated to execute and ready to drive success working with cross-functional stakeholders
• Provide legal advice pertaining to data protection laws and regulations and consumer protection laws
• Maintain knowledge of U.S., European, and other pertinent privacy and data security laws, regulations, and standards, including the GDPR, CCPA, FTC Act, FERPA and other applicable state and federal privacy, data security and consumer protection privacy laws and regulationsBe responsible for alignment to established privacy frameworks (e.g., NIST)
• Effective at educating others about and implementing robust privacy controls
• Develop guidelines, training, and tools to support accountability and compliance across the organization
• Be interested in working for a mission-driven company that powers educational opportunities for students around the world
• No Direct Reports. Works closely with privacy team based in Cape Town and US and 2U compliance/consumer protection function