GAQ327R249

Databricks is seeking a talented and experienced privacy attorney to lead our privacy compliance program and help the Databricks legal team provide cutting-edge, practical legal advice as we navigate rapidly evolving global laws and regulations in big data — including data privacy, data protection, and AI. This role reports to the Director & Assistant General Counsel, Privacy. As the day-to-day owner of the privacy compliance program, you will be responsible for developing AI solutions for operating and maturing the controls that keep Databricks compliant, and serve as a trusted advisor to business partners across the company.

You will be agile, highly organized, and have the skills, drive, and flexibility to build and scale a program at a leading technology company, addressing cutting-edge legal issues and organizational challenges. A successful candidate will be an AI proficient builder, resourceful self-starter, comfortable working in a fast-paced and dynamic environment, and excellent at building strong relationships and driving cross-functional execution.

The impact you will have

• Program Leadership: Own day-to-day operation of the Databricks privacy compliance program. Define priorities, establish and track program metrics and KPIs, and report on program health, risks, and maturity.
• Business and Legal Judgment: Exercise practical judgment about when to approve, approve with conditions, decline, or escalate.
• Privacy Program Compliance: Lead the further development, implementation, and continuous improvement of core program components — data subject rights requests, data inventory and data mapping (ROPA), records of processing, privacy by design, and the policies and processes that make the program run. Operate and improve the effectiveness of critical privacy compliance workflows.
• End-to-End Privacy by Design & Risk Assessments: Develop privacy review processes for the full data and product lifecycle — from ideation to end of life. Improve.
• Contract Negotiation and Transactions: Draft and update form agreements, and counsel on and negotiate data protection provisions in commercial contracts, including data processing addendums (DPAs), standard contractual clauses (SCCs), and related data-transfer instruments.
• Regulatory Analysis & Engagement: Monitor, research, and evaluate the applicability and impact of global privacy and AI laws, legislation, and regulatory guidance on new business initiatives. Support responses to regulator inquiries, audits, and enforcement developments.
• Policy Development: Develop, review, and maintain privacy policies, standards, notices, and procedures to align with legal requirements and best practices.
• Process Improvement: Contribute to developing and refining the processes that improve the privacy function, and partner with your stakeholders to build scalable process improvements as the business grows.
• Cross-Functional Collaboration & Legal Partnership: Build deep cross-functional relationships and collaborate with other legal leaders in commercial, go-to-market, compliance, corporate, and public affairs on privacy issues. Own the privacy training and awareness program, delivering strategic and timely enablement to keep the organization compliant.
• Incident Response: Advise on privacy and cybersecurity issues as a member of incident response teams, including breach assessment, notification analysis, and remediation, in partnership with the Legal Product team and Security.
• Team Contribution: Provide general legal support on a flexible, as-needed basis with respect to other areas of the business, and contribute as a team player to further the legal department's reputation as an effective, respected, and valued resource within the company.

What we look for

• 7+ years of relevant legal experience at a top law firm and/or in-house (a combination of both is a plus), with 5+ years focused on privacy and demonstrated experience building, operating, or leading a privacy compliance program (not solely advisory work)
• Deep, current knowledge of global privacy frameworks, including the GDPR/UK GDPR, CCPA/CPRA and the growing patchwork of U.S. state comprehensive privacy laws, and familiarity with cross-border data transfer mechanisms (SCCs, IDTA, adequacy, EU-U.S. Data Privacy Framework)
• Working knowledge of the operational building blocks of a privacy program — DPIAs/PIAs, ROPA and data mapping, data subject rights processes, privacy by design, and vendor/third-party risk management
• Capacity to be a generalist and learn new areas of law and legal skills quickly as the business evolves
• Deep understanding of cloud and software technology, and a strong desire to work on legal issues in these areas
• Experience working for a company offering platform services to business customers is a plus
• Familiarity with privacy management tooling (e.g., OneTrust or comparable) is a plus
• J.D. from a top-tier law school
• State bar membership required, in good standing
• One or more privacy certifications (e.g., CIPP/E, CIPP/US, CIPM, CIPT, FIP) preferred; CIPM is particularly valued for a program-leadership role

What you bring

• You can set direction for a program and drive it to execution — prioritizing and managing time and client expectations in the face of competing demands, often without direct guidance, as we scale our rapidly expanding business.
• You exercise good judgment in raising issues, assessing risk, and providing concise, actionable, business-focused legal advice and counsel.
• You build strong, deep working relationships with internal stakeholders across multiple geographies and functions, and are comfortable working with distributed teams.
• You are a self-starter who operates independently and interacts confidently with senior management, influencing without authority.
• You have a strong work ethic, excellent organizational skills, and the ability to manage many cross-functional projects simultaneously with minimal supervision.
• You have outstanding written and verbal communication skills, and can make complex privacy and regulatory concepts clear to both legal and non-legal audiences, including executives.