Legal Counsel — Cyber Security, Technology Safety & Physical Security
The role
The Legal Counsel provides senior, practical, risk-based legal counsel at the intersection of cybersecurity, Artificial Intelligence, cloud compute and services, physical security, supply chain and technology oriented regulatory compliance. The counsel will work closely with Security teams to support their efforts to address the needs of the company's various business units, and enable the attainment of the company's business and product objectives while protecting the company from obligations that are unclear, disproportionate, operationally unachievable, or inconsistent with the company’s security posture. The role is expected to lead cross-functional initiatives, not only respond to individual legal requests.
Your responsibilities will include
Security terms in customer contracts
Review, draft, and negotiate cybersecurity, physical security compliance, , supply chain and resilience provisions in customer documents, including MSAs, DPAs, security addenda, order forms, and related schedules.
Advise on security-control commitments, audit and assessment rights, incident-notification obligations.penetration testing, business continuity, data retention and deletion, subcontractors, cloud services, and allocation of liability.
Translate technical controls and architecture into clear, supportable contractual language without overstating capabilities or creating unbounded obligations.
Advise Product and Engineering on customer-driven requirements and translate recurring negotiations into scalable product, policy, and commercial positions.
Support Sales and Customer Success with timely, commercially pragmatic guidance during strategic and high-value transactions.
Certifications, audits, and external assurance
Provide legal support for security certifications, attestations, and assurance programs, such as ISO 27001, SOC 2, PCI DSS, or other frameworks relevant to the company.
Review certification scope, statements, evidence-sharing terms, management representations, auditor engagement terms, confidentiality obligations, and external communications.
Help ensure that customer-facing descriptions of certifications and controls are accurate, current, and do not imply broader coverage than the underlying assessment supports.
Partner with Security and Compliance on remediation plans, audit findings, regulator or customer inquiries, and the controlled disclosure of reports and evidence.
Security governance, regulatory advice, and risk
Managing DORA, NIS2, CRA frameworks, serving as principal point of contact with authorities in this respect.
Monitor and interpret cybersecurity, operational resilience digital-services, and technology requirements applicable to the company’s products, services, customers, and geographic footprint.
Assist in supporting physical security units
Assist the company GRC to advise on security policies, standards, risk acceptance, third-party risk, cloud governance, secure development practices, vulnerability disclosure, and responsible use of emerging technologies, including AI where applicable.
Participate in security and product governance forums and provide legal input to material risk decisions, secure development practices, control exceptions, product launches, vendor onboarding, and significant architecture or service changes.
Incident readiness and response
Support preparation and maintenance of cyber-incident response plans, notification matrices, decision logs, tabletop exercises, and external communication protocols.
Operations and enablement
Assessment and adoption of reference to specific legislation and regimes.
Develop playbooks, clause libraries, decision trees, intake forms, templates, and training that enable consistent handling of security-related legal work.
Define service levels and prioritization rules with Legal and Security; track volume, cycle time, recurring negotiation themes, exceptions, and material commitments.
Deliver practical training to Security, Sales, Product, Engineering, Procurement, and Customer Success teams.
Recommend process and tooling improvements that reduce manual work while maintaining appropriate legal and security review.
We expect you to have
Law degree and admission to practice, or equivalent professional legal qualification in a relevant jurisdiction.
Typically 7+ years of relevant legal experience, including significant in-house responsibility for technology, cybersecurity, cloud services, product counseling, commercial contracts, or regulated products.
Demonstrated progression into a senior counsel, legal director, or comparable leadership role with ownership of complex, business-critical matters.
Demonstrated experience negotiating customer security and data-protection terms and advising Security, Product, Engineering, and executive stakeholders.
Working knowledge of common security and assurance frameworks and the ability to understand technical concepts sufficiently to assess legal and contractual implications.
Strong judgment, concise drafting, executive communication, strategic project management, and the ability to prioritize multiple time-sensitive matters in a commercial environment.
High integrity and discretion when handling privileged, confidential, security-sensitive, or incident-related information.
It will be an added bonus if you have:
Senior in-house experience with a SaaS, cloud, cybersecurity, enterprise technology, or other business-to-business technology company.
Experience supporting security certifications, external audits, trust centers, public-sector customers, or highly regulated customers.
Experience with global cybersecurity and resilience regimes and with coordinating advice across multiple jurisdictions.
Experience building scalable legal intake, contract playbooks, knowledge bases, workflow automation, or legal-operations programs.
Prior work involving cyber affairs, government, defense, international or regional legal matters, or other high-stakes regulated environments.
An advanced degree or formal specialization in international law, technology law, cybersecurity, privacy, or a related discipline.