Director, Data Security Counsel

Job Requisition ID #

Position Overview

With Autodesk software, you have the power to Make Anything. The future of making is here, bringing with it radical changes in the way things are designed, made, and used. Autodesk is continually ranked a top place to work by Fortune, Forbes, Glassdoor, and others.

As Director, Data Security Counsel, you’ll have the opportunity to use your legal skills in a career that combines innovative technology and creativity, helping both creative and engineering types build a better world. Data Protection and Governance has become an increasingly important topic for global companies. Autodesk is committed to protecting the data of our global customers and employees.

The Director, Data Security Counsel will lead the cybersecurity legal function and be at the forefront of privacy, AI, and data protection issues. The Data Security Counsel will work closely with the Data Legal team, the Trust team, and other stakeholders to implement initiatives necessary for compliance with global data security laws and regulations. The Data Security Counsel will develop strategies and initiatives to engage with key stakeholders and raise awareness of data security compliance and governance across the company.

Preference for candidates in Washington DC, Portland, or Boston. Qualified candidates from other locations may also be considered. The position reports to the Sr. Director, Data Legal.

Responsibilities

• Provide expert legal advice, research and track global data security legislation, evolving regulations, and enforcement and translate that into clear, concise, and actionable guidance

• Partner with members of the Legal team, Trust team, and other stakeholders to ensure Autodesk’s compliance with data security laws, regulations, customer, and vendor contracts

• Provide support and counsel during cybersecurity-related investigations and the response to data privacy incidents, including breach notification and mitigation strategies, to minimize impact and maintain trust

• Provide legal support to the Global Risk & Compliance team in connection with security certifications for Autodesk products, including SOC 2, ISO, FedRAMP, C5, and other industry and geo specific certifications

• Provide guidance to Legal and Product teams on data protection issues pertaining to new and existing products/features throughout the entire development lifecycle

• Provide legal guidance on regulatory, third-party, and internal security audits, and work with teams to scope and perform mitigation and remediation activities

• Draft and negotiate data security terms in contracts with customers (including public sector), vendors, and business partners

• Provide legal guidance on data security matters for M&A acquisitions, enabling risk decisions and integration of acquisitions into Autodesk Trust framework

• Respond to customers’ data security questions

• Assist with renewals of Autodesk’s cybersecurity policy

• Help enhance the global Trust program, including operations and documentation, employee training on data privacy and security obligations, promoting a culture of awareness and compliance throughout the organization, policy enforcement, compliance program monitoring and auditing, and third-party risk assessment

• Help prepare board and executive presentations, regulatory filings, and other legal disclosures to ensure accuracy and completeness of cybersecurity representations

• Support global AI governance, helping the business teams continue innovating responsibly

• Responsible for leading a small team of one direct report.

Minimum Qualifications

• Juris Doctor and active membership in at least one state bar

• 10+ years of relevant work experience practicing attorney in a law firm, government agency, or in-house legal team, with a substantial number of those years focused on cybersecurity and incident response

• Subject matter expertise in US and global data security and protection laws and regulations (including U.S. state laws and international data protection frameworks such as NIST, SEC cybersecurity requirements, and the EU's GDPR, DORA, and AI Act)

• Knowledge of cybersecurity requirements and certifications including FedRAMP, SOC2, ISO, C5, UK Cyber Essentials, DART, TX-RAMP, NIS2

• Experience with data loss prevention and cybersecurity events, including forensic investigations, breach notifications, and cybersecurity preparedness

• Experience representing technology and cloud-based companies

• Strategic vision and ability to spot issues