About the RoleWe are seeking a strategic and hands-on Privacy Counsel to join Beacon's legal team as our first dedicated privacy specialist. This is a foundational role: you will build Beacon's privacy strategy and architecture from the ground up, establishing the frameworks, policies, and processes that will govern how Beacon and its growing portfolio of vertical market software companies collect, use, and protect data. Reporting to Beacon's VP, Legal, you will partner closely with our IT, Governance, and Risk leader to architect a privacy program that is robust, scalable, and fit for a multi-jurisdictional technology acquirer. You will own data privacy end-to-end across the deal lifecycle - from pre-acquisition diligence through integration and post-close operations - while also advising on day-to-day privacy matters across the Beacon platform. This is a high-impact, high-autonomy role for a privacy lawyer who wants to build something lasting, not just maintain the status quo.
What You'll Do- Privacy Program Architecture: Build and own Beacon's enterprise data privacy program from inception. Establish the foundational strategy, governance structure, and operating model for privacy across Beacon and its portfolio companies. Define Beacon's privacy principles and risk appetite, and translate them into practical policies, controls, and accountability structures that can scale as the portfolio grows.
- M&A Privacy Diligence & Integration: Own the data privacy workstream across the full deal lifecycle. Conduct and lead privacy due diligence on acquisition targets - assessing data inventories, consent frameworks, cross-border transfer mechanisms, regulatory exposure, and historical compliance posture. Develop standardized privacy diligence checklists and playbooks. Post-close, lead privacy integration planning and execution, ensuring acquired companies are brought into alignment with Beacon's privacy standards in a structured, risk-based manner.
- Policy, Process & Template Development: Draft, implement, and maintain Beacon's core privacy documentation - including privacy policies, data processing agreements (DPAs), records of processing activities (ROPAs), consent frameworks, data subject rights (DSR) procedures, data retention schedules, and vendor privacy terms. Build a library of reusable templates and precedents that can be deployed efficiently across the portfolio.
- Cross-Functional Partnership: Serve as the primary privacy advisor to Beacon's IT, Governance, and Risk function. Work collaboratively with engineering, product, and operations teams at Beacon and within portfolio companies to embed privacy-by-design principles into technology development, data infrastructure, and business processes. Translate complex regulatory requirements into clear, actionable guidance for non-legal stakeholders.
- Multi-Jurisdictional Compliance: Monitor and advise on compliance with applicable data privacy laws across the jurisdictions in which Beacon and its portfolio companies operate, with particular depth in U.S. federal and state privacy law (including CCPA/CPRA and sector-specific regimes), Canadian federal and provincial privacy law (PIPEDA and Law 25/Bill 64), and EU/UK GDPR. Identify and manage cross-border data transfer requirements and implement appropriate transfer mechanisms.
- Data Breach Incident Response: Develop and maintain Beacon's data breach and privacy incident response playbook. Serve as legal lead on privacy incidents - advising on investigation, containment, notification obligations, and regulatory reporting across multiple jurisdictions. Coordinate with IT security, external counsel, and senior leadership on material incidents.
- Vendor & Third-Party Privacy Management: Own Beacon's third-party privacy risk framework, including vendor assessments, DPA negotiations, and ongoing monitoring. Ensure that data sharing arrangements with service providers, partners, and portfolio company vendors meet applicable legal requirements and reflect Beacon's privacy standards.
- AI & Emerging Technology Privacy: Advise on the privacy implications of Beacon's use of AI tools and data-intensive technologies across the platform. Develop guidelines for responsible data use in AI and machine learning contexts, and stay current on evolving regulatory expectations in this space.
- Training & Privacy Culture: Design and deliver privacy training and awareness programs for Beacon and portfolio company employees. Foster a culture of privacy accountability and build internal capacity so that privacy considerations are embedded in day-to-day decision-making across the organization.
Who You Are- J.D. from an accredited law school and member in good standing of at least one bar (California, New York, preferred)
- 7+ years of privacy law experience at a top-tier law firm, or 5-7 years of in-house privacy counsel experience at a technology company operating in a data-heavy environment.
- Demonstrated experience building or leading a privacy function, including developing privacy programs, policies, and governance frameworks - not just advising on them.
- Deep expertise in multi-jurisdictional data privacy law, with substantive knowledge of U.S. (CCPA/CPRA, HIPAA, FERPA, and applicable state laws), Canadian (PIPEDA, Law 25/Bill 64), and EU/UK (GDPR) privacy regimes. Experience navigating cross-border data transfer requirements and international compliance obligations.
- Hands-on experience advising on diverse data types, including personal data, sensitive personal information, health data, financial data, and B2B data, across a range of industries and use cases.
- Experience conducting or advising on privacy due diligence in M&A transactions, and familiarity with privacy considerations in corporate transactions, vendor relationships, and technology deployments.
- Strong instincts for pragmatic, business-enabling privacy advice - able to identify and quantify risk, recommend proportionate controls, and help the business move forward rather than defaulting to "no."
- Proficiency with AI tools for legal and privacy work, and a genuine interest in leveraging technology to build efficient, scalable privacy operations.
- Excellent written and verbal communication skills, with the ability to translate complex regulatory requirements into clear, actionable guidance for technical and non-technical stakeholders alike.
- Experience with vertical market software, SaaS, or multi-product technology platforms is a strong plus.
