Senior Privacy, Security & AI Counsel

Role Overview:

With a mission to fundamentally transform U.S. healthcare, Collective Health is the ideal workplace for a self-starting, team-oriented attorney who wants to make a major impact and assume meaningful responsibilities at a fast-growing health-tech company. We seek a business-minded attorney to become our Senior Data Security & AI Counsel, proactively working on data security and AI needs. This role will provide high quality, pragmatic legal counsel on a broad range of cybersecurity, data protection and AI matters as well as operational guidance to the product and engineering teams on product development and launch. The job will also involve drafting and negotiating commercial terms to help ensure compliance and risk management in a rapidly evolving environment. This position is vital in driving business innovation within a complex technical and regulatory context.

What you'll do:

• Regulatory Advisor:
  • Stay apprised of changing state and federal laws and direct the business on practical implementation of privacy, security, and AI requirements for business operations, vendor engagements, and product development.
  • Proactively translate state and federal privacy, security, and AI laws into actionable strategies, product requirements and contract terms for business and product teams and assist in development of training and awareness programs.
  • Advise regulatory attorneys on privacy, security, and AI implications of healthcare related laws, such as ERISA and the ACA, as they relate to third party administrator functions, claims data, and required communications.
• Commercial Contracting Support:
  • Draft and negotiate privacy, security and AI terms and agreements, i.e., Business Associate Agreements, Data Security Agreements, and working with commercial attorneys to align terms with product capabilities and company processes while effectively managing privacy, AI, and security risks.
  • Empower business and sales teams by providing expert guidance on privacy, security, and AI questions in Requests for Proposals and customer questionnaires.
  • Provide strategic legal review, guidance and contract terms for data use, ownership, indemnification, and limitations of liability aligned with state and federal privacy, AI, and security laws and best practice to support the development and evolution of products.

• Product, Engineering and AI Support:
  • Remain current on evolving AI laws to educate and provide support to the business to ensure ongoing compliance with privacy, security, and AI-specific regulation, framework, policies, and guidance.
  • Proactively identify and mitigate security and AI risks associated with new product features and commercial initiatives, ensuring 'security by design' and 'privacy by design' principles are embedded from conception and engage with product and engineering teams on new development initiatives, providing clear, practical legal guidance.
  • Direct teams in the legal classification of AI systems, assessment of risks, and AI governance frameworks, including development of policies and procedures for ethical AI development, deployment, use, and risk mitigation, ensuring responsible innovation and addressing potential biases and fairness in product offerings.
  • Guide cross-functional stakeholders on AI principles such as governance, transparency, accountability, and human-oversight.
  • Work cross-functionally on a privacy and data governance program (covering data classification, retention, quality, access and disposal) ensuring compliance and enabling data-driven product innovation.

• Privacy & Data Security Support:
  • Act as a legal partner to the Privacy Officer and the Chief Information Security Officer to proactively advise on federal and state privacy and data security obligations, applicable external certifications and benchmarking frameworks (e.g., HITRUST, NIST, NYDFS, SOC2), including participating in tabletop exercises.
  • Assist with drafting, updating, and operationalizing cybersecurity, and data protectio