This position provides legal counsel in the areas of technology, privacy, data licensing or ownership, and cybersecurity or data breach incident response. This position also serves as the privacy officer for the organization. This position will contribute or develop substantial subject-matter expertise in the following areas:

• U.S. privacy laws, such as California Consumer Privacy Act (CCPA/CRPA) and the Gramm-Leach-Bliley Act (GLBA).
• Technology contracting, including software as a service (SaaS) agreements and master services agreements.
• Data ownership, licensing, and use restrictions.
• U.S. data security laws, such as state data breach notification laws or the model insurance data security act promulgated by the National Association of Insurance Commissioners.

This position works in a team environment, as a member of the legal team, and will have the opportunity to collaborate with other members of the legal & compliance department. The successful candidate may work from any available Compeer Financial office location in Illinois, Minnesota, or Wisconsin. However, Bloomington, IL; Naperville, IL (near Chicago, IL); Lakeville, MN (near Minneapolis/St. Paul, MN); or Sun Prairie, WI (near Madison, WI) are preferred. 

Essential Functions:

• Provide legal analysis and advice regarding technology initiatives and strategy, including counseling and collaborating on regulatory, privacy, security, intellectual property, and other issues.
• Structure, review, draft, and negotiate a wide variety of agreements for technology and services, including software as a service (SaaS) agreements, cloud services agreements, API licenses, data licenses, vendor contracts, online terms of service, privacy statements or privacy policies, data processing agreements, professional services agreements, outsourcing agreements, joint development agreements, and other technology contracts.
• As a member of the vendor management oversight team, lead our legal and privacy due diligence on all significant vendors.
• As the organization’s privacy officer, lead efforts to design and implement the organization’s privacy program by incorporating privacy and data controls into the organization’s technologies.
• As a member of the security incident response team, perform data breach and privacy risk assessment, documentation, and mitigation.
• Provide legal analysis and advice regarding the law of electronic signatures, including authentication risk, admissibility, and eVaulting.
• Counsel the security and compliance teams on matters related to prevention, preparedness and response related to security incidents, privacy compliance, and data breach notification obligations.
• Counsel the information technology, data, and quantitative analysis teams on matters related to privacy compliance; data collection, use, and governance; and data ownership, licensing, and use restrictions.
• Educate technical teams on privacy, data protection, and data use restriction requirements, and raise awareness of developments in the data regulatory landscape.

Minimum Qualifications & Required Knowledge, Skills and Abilities:

• Bachelor's degree and a JD from an American Bar Association accredited law school.
• Ability to obtain a professional license to practice law in Minnesota, Wisconsin or Illinois.
• 3+ years’ experience (7+ years preferred) in a law firm or corporate law department providing legal advice relating to complex technology agreements, privacy, data ownership/licensing, or related subjects.
• IAPP certification (CIPP/US, CIPM, or CIPT) or equivalent employment history preferred.
• Technical expertise preferred, such as prior experience or knowledge of:
  • Data security and privacy
  • Information technology
  • Software development
  • Digital advertising
  • SaaS or cloud solutions.
• Functional knowledge (or ability to develop functional knowledge) of common cybersecurity, privacy, or IT risk management frameworks, such as the CIS Controls, NIST CSF, NIST Privacy Framework, ISO 27001, and FTC Guidelines.
• Expertise in the law and industry standards related to data use and analytics, including privacy, data breach notification, security, and intellectual property.