Legal Counsel - Privacy, AI, & Digital Governance

Please Note: This is a Utah-based hybrid position which will require some regular in-office days each week. Additionally, employment with BambooHR is contingent on passing both a background and credit check.

AI at BambooHR
At BambooHR, we’re all about setting people free to do great work, and we believe AI is a powerful partner in that mission. We’re leaning into intelligent tools to streamline our workflows, giving us more time for high-impact innovation. We look for curious, forward-thinking people who are ready to explore how AI can elevate their work and help us reimagine the future of HR.  

Essential Job Duties

At BambooHR, we believe doing great work starts with having a great quality of life. That's why we're committed to creating an environment where our employees can thrive both professionally and personally.

As BambooHR continues to grow and innovate, we're expanding our focus on privacy, data protection, and responsible AI practices. We're looking for an Associate Legal Counsel who is passionate about helping organizations navigate evolving regulatory requirements while building practical, scalable programs.

In this role, you'll report to the Associate General Counsel, Privacy, AI, and Digital Governance and partner closely with cross-functional stakeholders  to support BambooHR's privacy and AI governance initiatives. You'll help translate legal and regulatory requirements into actionable business practices, contribute to innovative solutions and support the development of policies, processes, and controls that promote trust, transparency, and responsible innovation.

You will:

• Partner with and support the Associate General Counsel, Privacy, AI, and Digital Governance in executing legal, operational, and transactional program activities that advance a regulator-ready privacy and AI governance program.
• Manage annual updates to privacy program documentation, including privacy notices, customer contract addendums, policies, and other templates. ensuring materials remain current, accurate, and audit-ready.
• Manage legal review and escalations for privacy and AI rights requests and support day-to-day adherence to applicable privacy regulations, maintaining organized and defensible records of program activities.
• Work with cross-functional stakeholders throughout BambooHR on a variety of AI, privacy and data protection matters — including incident response, risk assessments, and control gap remediation — with clear escalation to the AGC on matters with significant legal exposure or strategic implications.
• Support privacy program operations related to marketing technologies, website operations, cookie consent management, and data collection practices, balancing business enablement with regulatory defensibility.
• Assist AGC in identifying and addressing privacy and AI-related legal considerations, serving as a practical and solutions-oriented resource that enables BambooHR's AI-first objectives while building the governance guardrails needed to sustain them.
• Support adherence with GDPR, CCPA/CPRA, emerging U.S. state privacy laws, and evolving AI regulatory frameworks, proactively monitoring developments and flagging material changes that warrant AGC attention or program-level updates.
• Assist with conducting privacy and AI impact assessments and assist with risk evaluation and mitigation efforts, exercising sound judgment about when to escalate issues, propose alternatives, or seek direction from the AGC before proceeding.
• Monitor legal and regulatory developments related to privacy, data protection, and artificial intelligence, and provide practical guidance to internal stakeholders.

What You Need to Get the Job Done

• Juris Doctor (J.D.) degree or equivalent legal experience.
• 3–5 years of experience supporting privacy, data protection, AI governance, , cybersecurity or technology-related functions.
• Working knowledge of privacy laws and regulations, including GDPR, CCPA/CPRA, HIPAA, GLBA, and other emerging privacy requirements.
• A strong interest in AI governance, AI risk management, or emerging AI regulatory frameworks.
• Ability to interpret legal and regulatory requirements and translate them into practical business solutions.
• Strong project management and organizational skills with the ability to manage multiple priorities simultaneously.
• Excellent written and verbal communication skills.
• Strong attention to detail and analytical problem-solving abilities.
• Collaborative mindset and ability to work effectively across multiple business functions.

What Will Make Us REALLY Love You 

• Experience supporting privacy programs within a SaaS or high-growth technology company.
• Experience conducting privacy impact assessments, AI risk assessments, or vendor reviews.
• Experience managing transactional privacy operations such as policy development, training, incident response, vendor risk management, and appropriate data use.
• Familiarity with AI governance frameworks such as the NIST AI Risk Management Framework, ISO standards, or emerging AI regulations.
• Experience partnering with cross-functional teams, such as Legal, Security, Risk, Security, and Product teams to operationalize regulatory requirements.
• In-house experience supporting privacy,  security, or responsible AI initiatives.
• Passion for helping organizations build trustworthy, and responsible technology and governance practices

What You'll Love About Us

• A Great Company Culture that has been recognized by multiple organizations like Inc, and Salt Lake Tribune
• Comprehensive health, life, and disability insurance 
• Generous leave policies that include 4 weeks of vacation, 12 company holidays, parental leave, and volunteer time off so you can enjoy quality of life
• 401k plans with up to 6% company match
• $2000 Paid-Paid Vacation bonus
• EAP through Headspace
• Check out all our benefits that benefit you