Data Privacy Officer and Sr. Product Counsel

23andMe is seeking an exceptional and highly collaborative Data Privacy Officer and Sr. Product Counsel to join our team! 

Who We Are

Since 2006, 23andMe’s mission has been to help people access, understand, and benefit from the human genome. We are a group of passionate individuals pushing the boundaries of what’s possible to help turn genetic insight into better health and personal understanding.

About This Role

With a thorough understanding of 23andMe’s business and strategic priorities, you will lead the Privacy and Product Legal team and report to and collaborate with the General Counsel to ensure 23andMe maintains its focus on transparency and leadership in privacy, data protection, and legally compliant products. You will manage the team’s execution, which includes identifying and addressing the privacy, data use, data governance, and health law implications of cutting-edge products, marketing, research, and strategic initiatives. You will apply your technology, e-commerce, and healthcare knowledge and experience to guide the product development lifecycle, working with cross-functional stakeholders in a fast-paced environment. You will provide thought leadership on privacy and technology policy and work closely with internal and external parties on policy and government affairs matters.

This role will be based in our Sunnyvale, CA headquarters and report to the General Counsel. The role may be remote for the appropriate candidate.

What You’ll Do

• Develop and enhance the company’s privacy and data governance policies, standards and practices, including compliance with laws in the U.S. and globally.
• Build, manage, and motivate the Privacy and Product Legal team, fostering a collaborative and inclusive work environment.
• Support Product, Marketing, Research, Security, IT, and other business teams to develop and implement solutions that comply with 23andMe’s privacy and data protection policies and procedures. 
• Coordinate with Product and Engineering teams, including ensuring privacy by design, data governance, and healthcare compliance for product launches and initiatives.
• Assess how current and proposed laws and regulations impact business processes, reporting, record keeping, and other activities. Identify the need for, and advise on the introduction of new business processes, consultations, or training.
• Collaborate with contracts, procurement, and business development teams, including responsibility for creating policies, processes, and templates and reviewing and negotiating contracts to support transactions involving customer, patient, and/or research participant data.
• Develop strategies, tools, resources, and frameworks enabling data use and healthcare delivery innovation while ensuring adherence to applicable standards.
• Perform/oversee privacy and data protection risk assessments and proactively monitor and identify opportunities, issues, and risks. Develop mitigation plans to support company risk management and internal audit reporting.
• Member of the data protection governance committee, as well as incident response and resolution leadership.
• Represent 23andMe’s privacy and data protection interests with external parties.
• Develop, monitor, remediate, and report performance metrics for privacy and data protection.

 What You'll Bring

• JD with excellent academic credentials and a member of a U.S. state bar, preferably including the State Bar of California.
• 10+ years of privacy experience in a law firm, in-house, or other legal role with a track record of providing practical business-friendly advice. CIPP/US/E certification preferred.
• 5+ years of product counseling experience for innovative technology and/or health data companies.
• People management experience  -- proven experience managing, motivating, and developing a high-performing legal team.
• Expert knowledge of data protection and information security laws, rules, and regulations in the US and globally, including CPRA and other state consumer privacy laws, COPPA, privacy practice under the FTC Act, and GDPR, as well as leading privacy and data protection practices and standards.
• Significant experience successfully implementing privacy-focused projects with efficiency, including data mapping, data privacy impact assessments, and third-party risk assessments, as well as in negotiating complex agreements involving personal data. 
• Knowledge of online and offline advertising and marketing rules and regulations, including state consumer protection statutes, CAN-SPAM, TCPA, and FTC guidelines pertaining to 23andMe’s business.
• Experience with health privacy laws, including GINA and HIPAA, as well as associated privacy a