Director – Privacy Counsel

Location: Brisbane, California or Remote (Central/West Coast preferred)

Position Summary:

Vera Therapeutics is seeking Privacy Counsel to join its legal team and report to the SVP, Deputy General Counsel. This role is the company's in-house privacy expert, responsible for addressing the full range of Vera's privacy needs across clinical, commercial, corporate, and employee data, in the U.S. and globally.

The Privacy Counsel will serve as a trusted advisor to internal stakeholders across R&D, Clinical, Commercial, Compliance, IT, HR, and Finance. The role requires someone who can work independently, exercise sound judgment, and deliver clear, practical recommendations even when the facts are incomplete. The ideal candidate brings deep life sciences privacy experience, understands the handling of protected health information (PHI) and personally identifiable information (PII), and can balance risk mitigation with the business's need to move quickly. This is an opportunity to shape and build a privacy program at a growing biotech as it advances its pipeline and builds out its commercial operations.

Responsibilities:

• Own privacy legal strategy: Serve as the company's primary privacy counsel, advising on all privacy matters across clinical development, commercial operations, corporate functions and IT.
• Advise internal stakeholders: Provide timely, actionable guidance to business partners and leadership, including making clear recommendations when facts are incomplete and clearly communicating residual risk.
• Navigate U.S. and global privacy law: Advise on compliance with CCPA/CPRA, CIPA, HIPAA, FTC requirements, other state privacy and consumer health data laws, GDPR, the UK GDPR and Data Protection Act, and other international privacy regimes as Vera's activities expand.
• Develop policies and procedures: Identify gaps in Vera’s privacy and data governance framework and independently draft, implement, and maintain the policies, procedures, and guidance needed to meet company and legal requirements, tailoring them to the needs of each business function.
• Address PHI and PII issues: Advise on the collection, use, storage, disclosure, and cross-border transfer of PHI and PII, including in clinical trials, patient support, commercial, and employee contexts.
• Manage vendor and third party privacy risk: Review and negotiate data protection terms, business associate agreements, data processing agreements, and international transfer mechanisms; support vendor privacy and security diligence.
• Build and maintain the privacy program: Develop and update privacy policies, notices, procedures, training, and records of processing; support data mapping, data protection impact assessments, and privacy by design in new initiatives.
• Respond to privacy events: Support the assessment of, response to, and notification obligations for privacy incidents and data security events, and handle data subject and consumer requests.
• Monitor the legal landscape: Track emerging privacy, health data, and AI related legal developments and translate them into practical guidance and program updates.
• Collaborate across the company: Partner with Compliance, IT, HR, Clinical, Commercial, and Finance to embed privacy into day to day operations and decision making, and work with outside counsel and consultants as needed.
• DPO/DPR Management: Manage all interactions with the company’s external DPO and DPRs globally.

Qualifications:

• Legal Expertise & Credentials: J.D. and licensed to practice law in good standing in at least one U.S. state, and authorized to practice in California as registered in-house counsel (if residing in California), with 8 to 10 years of legal experience focused on privacy, including law firm training and in-house experience.
• Life Sciences Experience (required): Demonstrated experience advising biotechnology, pharmaceutical, or other life sciences companies on privacy matters, including clinical research and commercial data practices.
• U.S. Privacy Law: Working knowledge of HIPAA, CCPA/CPRA, CIPA, and the growing body of state privacy and consumer health data laws.
• International Privacy Law: Working knowledge of GDPR, UK GDPR and the UK Data Protection Act, and cross-border data transfer requirements.
• PHI and PII Expertise: Familiarity with issues involving PHI and PII, including the transfer, collection, storage, and use of such data.
• Vendor Experience: Experience working with vendors on data protection terms, business associate and data processing agreements, and privacy and security diligence.
• Independent Judgment: Proven ability to work independently, make sound risk-based recommendations with incomplete information, and advise stakeholders at all levels, including senior leadership.
• Strategic & Pragmatic Thinker: Hands-on, pragmatic problem solver who can balance day to day requests with longer term program priorities.
• Interpersonal Excellence: Collaborative, intellectually curious, and an outstanding communicator who can explain complex privacy concepts clearly to non-lawyers and earn trust across the organization.
• Values-Driven & Mission-Focused: Committed to Vera's values and motivated by the mission to advance patient care and improve outcomes for individuals with serious immunologic diseases.
• Process and Operational Excellence Mindset: Ability to build practical processes, drive continuous improvement, and use technology and data to scale a privacy program.

For this role, the anticipated base pay range is 230000 - 280000 USD