Senior Legal Counsel - Cybersecurity & Privacy

Thomson Reuters is seeking a Senior Legal Counsel specializing in Cybersecurity and Privacy to serve as the primary legal advisor at the intersection of these fields. This role involves advising on incident response, breach notification, regulatory engagement, security program requirements, security control assessments, and the privacy and regulatory implications of products, cybersecurity architecture, and third-party risk management. The position collaborates closely with Information Security, Risk Management, Privacy Operations, and Commercial Legal teams, reporting directly to the Chief Privacy Officer. The scope of this role spans multiple regions, including the United States, European Union, Latin America, Europe, the Middle East, Africa, and Asia-Pacific.

Key responsibilities include leading legal analysis during security incidents and data breaches, engaging directly with U.S. state Attorneys General and other regulators on notifications, inquiries, and investigations, and developing and maintaining global incident response and breach notification playbooks. The role also involves advising on U.S. state breach notification laws, state comprehensive privacy laws (e.g., CCPA/CPRA, VCDPA), FTC Act Section 5, and applicable sector-specific requirements. Additionally, the Senior Legal Counsel will serve as a subject matter expert on GDPR security and breach requirements, NIS2, DORA, and the EU Cyber Resilience Act, conducting applicability assessments to determine which regimes apply to specific products, services, and business lines. The position also requires advising on cybersecurity and breach requirements across relevant APAC jurisdictions (e.g., Singapore PDPA, Australia Privacy Act and NDB scheme, Japan APPI) and, as scope requires, LATAM and EMEA. Monitoring evolving cybersecurity, breach notification, and privacy regulation across all regions and translating changes into practical guidance and updated playbooks is also a key aspect of this role.

The ideal candidate will possess a Juris Doctor (J.D.) and active bar membership in at least one U.S. jurisdiction, in good standing. A minimum of 8 years of experience practicing privacy and/or cybersecurity law, in a law firm, in-house, or both, is required. Substantive experience advising on data breach response and incident management, including direct engagement with regulators such as state Attorneys General, is essential. Strong working knowledge of U.S. privacy and cybersecurity law, including state breach notification statutes and CCPA/CPRA, is necessary. Expertise in EU cybersecurity regulation, including GDPR security and breach requirements, NIS2, DORA, and the EU Cyber Resilience Act, is also required. Working knowledge of federal security frameworks such as FedRAMP, NIST 800-53/800-171, and experience supporting security control assessments or authorization packages are important. Experience conducting or overseeing privacy risk assessments, including PIAs and DPIAs, is also required. The ability to operate calmly and decisively under time pressure and lead cross-functional stakeholders through high-stakes incidents is crucial.

Compensation for this role ranges from $119,700 to $222,300 per year. The position offers a hybrid work model, providing flexibility in work arrangements. Additional benefits include career development and growth opportunities, tuition reimbursement, mental health days, and wellness programs. Employees also have access to health, dental, and vision insurance, as well as retirement savings plans.

Thomson Reuters fosters a collaborative and inclusive company culture, emphasizing career development and growth opportunities. The organization offers a flexible hybrid working environment, allowing employees to work from anywhere for up to 8 weeks per year. Additional perks include flexible vacation, two company-wide mental health days off, and access to wellness resources. Employees are also encouraged to participate in pro-bono consulting projects and environmental, social, and governance (ESG) initiatives. This role provides an opportunity to work at the forefront of cybersecurity and privacy law within a leading global organization.