Counsel (Privacy and Cybersecurity)

COUNSEL (PRIVACY AND CYBERSECURITY)

About Carvana
At Carvana, we’re changing the way people buy and sell cars. With an ambitious vision and a fundamentally different approach designed to be fun, fast, and fair, Carvana became the fastest-growing automotive retailer in history. We expanded nationally, went public on the New York Stock Exchange, sold our 1 millionth car, and reached the Fortune 500, all in just eight years. 

Today, with 4 million retail customers and counting, Carvana is both the fastest-growing and the most profitable public automotive retailer, and we’re just getting started. We continue to raise the bar for our customers as we tackle the enormous opportunity still ahead in the largest consumer vertical.  

Working here means being part of a team that embraces change, celebrates creative problem solving, and always strives to be better. At Carvana, you’ll have the opportunity to take on meaningful challenges, learn quickly, and help shape the future of automotive retail. If you’re driven to grow and make an impact as part of a collaborative team, you’ll fit right in. Learn more about what it’s like to work here from the people that already do. 

About the team and position
Join Carvana’s Legal Department in the role of Counsel, Privacy & Cybersecurity! Carvana is looking for a motivated and proactive attorney to provide pragmatic and innovative advice, supporting legal and business stakeholders with various projects and assignments involving privacy and security. This role will report to the Senior Counsel, Privacy & Cybersecurity. You will also work closely with a variety of other internal business and legal partners on various matters relating to Carvana’s privacy and information security programs. 

As a key member of the Privacy team, you will support proactive and reactive legal work involving Carvana’s privacy and cybersecurity interests, including advising on the introduction of new solutions, marketplaces, and technologies; responding to internal and external inquiries, questionnaires, and claims; leading cross-functional efforts to develop and improve privacy and cybersecurity processes; and research and advise upon the ever-changing U.S. privacy and cybersecurity legal and regulatory landscape.

This is a fully on-site position, Monday through Friday, at our corporate HQ in Tempe, Arizona.

What you’ll be doing 

• Provide quick and innovative support to legal and business colleagues involving a wide variety of complex questions related to privacy and cybersecurity.
• Analyze statutes, regulations, case law, and other resources to stay up to date and advise legal and business stakeholders on new and changing privacy and cybersecurity regulations.
• Collaborate with our Privacy Legal and Privacy, Data, & AI Governance teams by providing legal guidance and support to strategically develop, update, and maintain Carvana’s operational privacy program.
• Assist with drafting and refining consumer notices, consents, and terms of use, with an eye toward clarity, brevity, and transparency, all in alignment with Carvana’s values.
• Review, draft, and negotiate data protection agreements and internal privacy policies.
• Advise product, engineering, and related stakeholders on privacy, data protection, and responsible data use in connection with new features, products, and initiatives.
• Provide legal guidance and support on the implementation, maintenance, and improvement of key privacy and data governance processes, including those involving risk and impact assessments, privacy rights request responses, and data retention and minimization practices.
• Assist with the development of creative solutions to ensure compliance with applicable third-party agreements, security attestations, and regulations.
• Support legal investigation into and response to cyber incidents.
• Support efforts to keep legal and business leadership updated and engaged with Carvana’s privacy and cybersecurity programs, including development of internal training, guidance, and related tools to raise awareness of privacy, cybersecurity, and data protection topics.
• Foster a self-driven approach, proactively issue spotting and working with appropriate internal and external legal experts to generate risk-based guidance.
• Other duties as assigned.

What you should have/know

• J.D. with an active bar membership in good standing in at least one U.S. jurisdiction.
• 3+ years of experience providing legal support to technology businesses at a firm and/or within a corporate legal department setting, although we will consider varying levels of legal experience combine