# Senior Counsel

**Company**: Thomson Reuters
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $119,700 USD - $222,300 USD
**Category**: Legal
**Industry**: Technology

**Apply**: https://thomsonreuters.wd5.myworkdayjobs.com/en-US/External_Career_Site/job/United-States-of-America-Frisco-Texas/Senior-Legal-Counsel---Cybersecurity---Privacy_JREQ204393?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_b776576f-318

## Description

We are seeking a Senior Counsel to serve as the primary legal advisor at the intersection of cybersecurity and privacy law.

The role advises on incident response, breach notification, regulatory engagement, security program requirements, security control assessments, and the privacy and regulatory implications of our products, cybersecurity architecture, and third-party risk management.

**Key Responsibilities:**

- Lead legal analysis during security incidents and data breaches, including real-time decision-making in incident response ('war room') efforts: triage, containment, notification obligations, and regulator and customer communication strategy.

- Engage directly with U.S. state Attorneys General and other regulators on notifications, inquiries, and investigations.

- Develop and maintain the global incident response plan and breach notification playbooks, aligned across US, EU, and APAC requirements.

- Advise on US state breach notification laws, state comprehensive privacy laws (e.g., CCPA/CPRA, VCDPA), FTC Act Section 5, and applicable sector-specific requirements.

- Serve as subject matter expert on GDPR security and breach requirements, NIS2, DORA (where applicable), and the EU Cyber Resilience Act.

- Advise on cybersecurity and breach requirements across relevant APAC jurisdictions (e.g., Singapore PDPA, Australia Privacy Act and NDB scheme, Japan APPI).

- Monitor evolving cybersecurity, breach notification, and privacy regulation across all regions.

- Advise on federal compliance obligations for US government business, including FedRAMP authorization, CMMC, HIPAA (where applicable), the Privacy Act, and federal incident reporting.

- Support security control assessments against NIST 800-53 Rev 5, NIST 800-171, and FISMA.

- Support FedRAMP and other federal authorization packages, including SSP control narratives and POA&M management.

- Conduct product privacy and security gap assessments and validate mitigations post-implementation.

- Advise product and engineering teams on privacy- and security-by-design for new products and features.

- Negotiate cybersecurity provisions in vendor and customer contracts (DPAs, security schedules, incident notification).

- Use OneTrust to manage incident tracking, risk assessments, PIAs/DPIAs, and regulatory reporting.

**Required Qualifications:**

- J.D. and active bar membership in at least one US jurisdiction, in good standing.

- 8+ years of experience practicing privacy and/or cybersecurity law, in a law firm, in-house, or both.

- Substantive experience advising on data breach response and incident management, including direct engagement with regulators such as state Attorneys General.

- Strong working knowledge of US privacy and cybersecurity law, including state breach notification statutes and CCPA/CPRA.

- Expertise in EU cybersecurity regulation (GDPR security and breach requirements, NIS2, DORA, and the Cyber Resilience Act).

- Working knowledge of federal security frameworks (e.g., FedRAMP, NIST 800-53/800-171).

- Experience conducting or overseeing privacy risk assessments, including PIAs and DPIAs.

- Ability to operate calmly and decisively under time pressure, and to lead cross-functional stakeholders through high-stakes incidents.

**Preferred Qualifications:**

- CIPP/US, CIPP/E, CIPM, or CIPT certification.

- Working knowledge of APAC breach and cybersecurity regimes (e.g., Singapore PDPA, Australia NDB scheme, Japan APPI).

- Experience advising a global organization with complex cross-border data flows.

- Experience with FedRAMP continuous monitoring, HIPAA, or CMMC.

- Hands-on experience with OneTrust or comparable privacy operations platforms.

- Familiarity with SOC 2, ISO 27001, or the NIST Cybersecurity Framework.

**What's in it For You?:**

- Hybrid Work Model: flexible hybrid working environment.

- Flexibility & Work-Life Balance: supportive workplace policies.

- Career Development and Growth: culture of continuous learning and skill development.

- Industry Competitive Benefits: comprehensive benefit plans.

- Culture: globally recognized, award-winning reputation for inclusion and belonging.

- Social Impact: make an impact in your community.

- Making a Real-World Impact: help uphold the rule of law, turn the wheels of commerce, and provide trusted information.

The base compensation range for this role is $119,700 USD - $222,300 USD.

## Skills

### Required
- cybersecurity law
- privacy law
- incident response
- breach notification
- regulatory engagement
- security program requirements
- security control assessments
- NIST 800-53
- NIST 800-171
- FISMA
- FedRAMP
- HIPAA
- GDPR
- NIS2
- DORA
- Cyber Resilience Act

### Nice to have
- CIPP/US
- CIPP/E
- CIPM
- CIPT
- APAC breach and cybersecurity regimes
- FedRAMP continuous monitoring
- CMMC
- OneTrust
- SOC 2
- ISO 27001
- NIST Cybersecurity Framework

---

Source: [Apply at thomsonreuters.wd5.myworkdayjobs.com](https://thomsonreuters.wd5.myworkdayjobs.com/en-US/External_Career_Site/job/United-States-of-America-Frisco-Texas/Senior-Legal-Counsel---Cybersecurity---Privacy_JREQ204393?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)