Senior Legal Counsel – Director, Privacy, Digital Products & AI Governance

Accountabilities: Serve as lead legal counsel for privacy, consumer information, and digital engagement matters across the consumer journey, from prequalification through contract origination. Advise on the collection, acquisition, processing, use, and sharing of consumer information, including Fair Credit Reporting Act (FCRA) permissible purposes, consumer-report authorizations, fraud prevention, notices, and consent requirements. Provide legal guidance on vendor products and data solutions involving consumer reports and other regulated information, particularly for identity verification, income verification, fraud prevention, and digital consumer engagement. Advise on consumer-facing digital communications, credit advertising, digital disclosures, adverse-action communications, and applicable consumer protection requirements, including the Truth in Lending Act (TILA) and Regulation Z. Partner with Product, Engineering, Marketing, Compliance, and consumer finance legal teams to design and launch digital marketplace capabilities, taking ownership of the privacy, consumer-information, FCRA, and consumer-facing advertising frameworks. Act as primary privacy and information security legal advisor to business and technical teams throughout the development and launch of new products, features, and initiatives. Monitor developments in federal and state privacy, data protection, and cybersecurity regulations, including the Gramm-Leach-Bliley Act (GLBA) and FCRA, translating complex legal requirements into practical, risk-based business guidance. Support enterprise privacy programs in collaboration with Information Security, Data Engineering, and Compliance, including privacy risk assessments, impact assessments, consumer privacy rights requests, data retention, and data minimization. Draft, review, and negotiate data protection agreements, privacy provisions, data-use restrictions, audit rights, security schedules, and technology-related contractual arrangements. Lead legal strategy and provide counsel during data breaches and cybersecurity incidents, including privilege considerations, notification obligations, and regulatory engagement. Support the development and implementation of the enterprise AI governance framework, including policies, standards, risk classifications, and AI system inventories. Design and maintain legal intake, review, and approval processes for AI tools and systems used across the organization. Draft and negotiate AI-related contractual provisions covering acceptable use, data rights, AI training restrictions, model outputs, ownership, and allocation of responsibilities with dealers, technology providers, and vendors. Establish legal standards for AI training data, model documentation, and data retention, using the NIST AI Risk Management Framework as a guiding standard. Advise on consumer and dealer disclosures when AI technologies influence customer experiences, shopping journeys, or dealer interactions. Monitor emerging federal and state AI legislation, regulatory guidance, and industry developments in collaboration with Government Relations. Partner with other legal teams on AI applications involving credit, fraud, and funding decisions, addressing fair lending, ECOA/Regulation B, model governance, explainability, and adverse-action requirements. Keep legal and business leadership informed of emerging regulatory developments, privacy and cybersecurity risks, and AI governance priorities. Requirements: Juris Doctor (J.D.) degree from an appropriately accredited institution and active membership in good standing with at least one U.S. state bar, with the ability to register as in-house counsel where required. At least 8 years of U.S. legal practice, with substantial experience in privacy, technology, digital products, data protection, or related regulatory matters. Demonstrated experience serving as product counsel for a consumer-facing digital platform or marketplace, including advising on the development and launch of new products, categories, or marketplace capabilities. Deep knowledge of U.S. federal and state privacy, data protection, and cybersecurity laws, including GLBA and FCRA. Significant experience developing, implementing, or operating privacy and data governance programs. Strong understanding of the NIST AI Risk Management Framework and emerging U.S. federal and state AI regulations. Hands-on experience advising on AI products and developing AI governance programs, including risk assessments, AI inventories, internal policies, and impact analyses. Proven ability to draft consumer notices, consent language, terms of use, privacy provisions, and negotiate complex data protection agreements. Demonstrated ability to interpret legislation, regulations, case law, regulatory guidance, and industry standards and translate them into actionable, business-oriented legal advice. Experience using AI-enabled legal tools responsibly and effectively, with examples of improvements in efficiency, quality, or risk identification. Strong legal judgment, analytical thinking, negotiation, problem-solving, and decision-making skills, particularly in complex and rapidly evolving regulatory environments. Excellent written and verbal communication skills, with the ability to explain sophisticated legal and technical concepts to non-legal stakeholders. Proven ability to lead cross-functional initiatives, influence senior stakeholders, manage competing priorities, and collaborate with internal and external legal and technical experts. Preferred qualifications: Experience in online automotive retail, automotive marketplaces, or automotive finance. Knowledge of consumer financial services regulations, including ECOA/Regulation B, TCPA, UDAAP, TILA/Regulation Z, and FCRA. Technical familiarity with software development, data architecture, cybersecurity, or machine-learning systems. A technical degree is advantageous but not required. Significant in-house legal experience within a technology, marketplace, e-commerce, or consumer financial services organization. ISO/IEC 42001 training or familiarity with AI management system standards. Experience engaging with regulators, industry associations, or standards-setting organizations. Professional certifications such as CIPP/US, CIPM, or AIGP. Benefits: Competitive annual base salary: $225,800–$263,400, depending on qualifications and experience. Annual bonus: Eligibility for an additional annual performance-based bonus. Retirement benefits: 401(k) plan with employer matching contributions. Comprehensive healthcare: Medical, dental, and vision insurance coverage. Family support: Adoption assistance and paid parental leave. Professional development: Tuition reimbursement and opportunities for continuous learning and career advancement. Remote flexibility: United States-based remote working arrangement. Well-being: Access to a comprehensive benefits package, including additional nontraditional employee benefits. Technology and resources: Access to modern tools and resources to support effective work and professional performance. Career growth: Opportunities for internal mobility, professional development, and increased leadership responsibilities. Meaningful impact: The opportunity to influence responsible AI adoption, strengthen consumer data protection, and support innovative digital financial services. Collaborative environment: Work alongside multidisciplinary teams in a culture that values innovation, inclusion, accountability, and diverse perspectives. How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether? Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time. #LI-CL1