Incident Response Lead Counsel

Incident Response Lead Counsel

The Incident Response Counsel (Lead Counsel 2) is a senior level position responsible for providing Citi businesses and functions, including technology teams, with integrated legal support, advice, and guidance on privacy matters with a particular focus on incident response across Citi globally. The role will be under the supervision of the Global Privacy Legal Group Manager and will coordinate closely with the Cybersecurity Legal team and the broader Technology, Operations, & Privacy Legal Team.

This role requires a pragmatic, proactive attorney with thorough understanding of privacy and data protection, particularly in the context of a global regulated financial services institution, combined with a solid substantive, conceptual, and practical grounding in compliance with the applicable laws, rules and regulations for the geographies in which Citi operates. The role will provide input into strategic and operational decisions and exercise sound judgment to develop proactive and risk-appropriate, and business-focused solutions.

Responsibilities:

• Working with the Privacy Legal Team, Cybersecurity Legal Team, and business colleagues on reviewing and responding to potential data privacy incidents, including data privacy analysis within cybersecurity incidents, to ensure a consistent, efficient and effective approach across jurisdictions in compliance with applicable privacy and security standards, laws, rules and regulations.
• Collaborating with in-country, business and function Legal teams to drive high quality, consistent, compliant and efficient incident response advice globally.
• Working with the Privacy Legal Team and Cybersecurity Legal Team to support internal stakeholders on all aspects of incident prevention and response in data privacy events, including investigations, customer and regulatory notifications, contractual obligations, and legal risk mitigation.
• Developing, implementing and engaging in ongoing enhancements of Legal playbooks, checklists, decision trees, process flows, toolkits, template documentation (including notification letters) and training for members of the Legal teams engaged on privacy incidents to help drive high quality, accurate, efficient, well documented, consistent and actionable legal analysis and advice around privacy incidents globally.
• Reviewing facts, relevant laws, rules and regulations, and applicable legal analysis to ensure that consideration has been given to all appropriate factors in identifying and assessing the need to make, and the manner of making, individual, regulatory and/or contractual notifications concerning data privacy and/or information security events, and supporting stakeholders' implementation of Legal's recommendations.
• Supporting and using technologies and software to assist in the handling, analysis, documentation and resolution of incidents.
• Escalating matters, as appropriate, to support legal and compliance risk identification and mitigation and company requirements.
• Developing, and engaging in ongoing reviews of, metrics to help validate legal sufficiency, accuracy and consistency of recommendations and timeliness (e.g., trend analysis and lessons learned, and identifying any process improvements needed).
• Working with and supervising outside counsel, as needed.
• Assisting with other projects within the Technology, Operations & Privacy Legal team as requested and when time permits.

Qualifications:

• An attorney with minimum of five (5) years' experience, three (3) years of which should be related to advising clients on privacy issues or incident response. Exceptional candidates with the necessary skill set may be eligible to be considered for the role, regardless of their level of experience.
• Knowledge of privacy and data protection laws, rules regulations, and practices, particularly around privacy incident response, as well as the regulatory and legal environment in which Citi operates.
• Proven background in privacy incident response, including investigations, notification determinations, compliance assessments, deploying industry-leading technologies and software solutions, and assisting with remediation and communication matters.
• Experience working with international teams in various time zones in a cross-functional multi-stakeholder environment.
• Self-starter with proven ability to apply sound judgment, engage directly with internal clients, manage multiple significant projects, and work well under tight time pressures. The candidate should be willing to work outside of normal business hours during emergency events.
• Excellent interpersonal, organizational, project management, prioritization, decision-making, and relationship management skills, and the ability to build and maintain trusted relationships.
• Strong verbal and written communication skills with the ability to interface with all levels of the organization.
• Excellent research and analytical skills. Strong documentation, presentation, and communication skills in a cross-functional and global role.
• Highly responsive and client relationship focused.
• Excellent attention to detail and strong and practical problem-solving abilities to deal with unforeseen events.
• Experience in successfully navigating ambiguity and fluid organizational structures.
• The candidate preferably should have experience working in or with global financial institutions.
• CIPP and/or other data privacy certifications is preferred.
• Ability to work independently with minimal supervision in a fast-paced and high-volume practice, prioritize competing demands, and problem solve creatively.

Education:

• Juris Doctorate or equivalent law degree