Director of Privacy and Cyber Legal Affairs

Overview

Join the Xanterra Travel Collection team:

Xanterra Travel Collection is a premier group of travel and leisure businesses with a focus on sustainability and exceptional service. Headquartered in Greenwood Village, Colorado, we operate iconic properties and services in stunning locations worldwide, including lodging, food and beverage, Windstar Cruises, short-line railroads, and adventure travel. We are dedicated to creating unforgettable experiences for our guests and providing transformative career opportunities for our team members.

We are seeking a dynamic and strategic Director, Privacy & Cyber Legal Affairs to join our team and lead our commercial, privacy, and cyber security guidance for Xanterra Travel Collection’s brand of companies (“Xanterra”).  This is a new role that will oversee Xanterra’s privacy program, working closely with key business partners in IT and Commercial.

Xanterra is growing its legal team to include a key role that will shape the future growth of the company in North America and Internationally. This position is located in Xanterra’s corporate offices in Greenwood Village, Colorado, will report to Xanterra’s Chief Legal Officer, and will work closely with Xanterra’s legal, IT, and Commercial teams to support overall privacy and cyber compliance.    

Responsibilities

What you will be doing:

• Be a key legal partner to our business teams, helping to shape secure, compliant, and innovative solutions across our platforms and services.
• Provide strategic legal advice on cybersecurity laws, regulations, and frameworks (g., NIST, PCI-DSS, SOC 2, ISO 27001, DORA, NIS2), as well as advice on global privacy laws, with a focus on North America, the United Kingdom, and Europe.
• Draft and refine cybersecurity and privacy policies, risk assessments, and governance frameworks.
• Advise and support cyber-related incident response planning, breach notification obligations, and post-incident reviews.
• Manage and oversee internal data privacy requests and adherence across the Company, partnering with IT and Commercial leadership.
• Prepare and revise vendor agreements and addendums to ensure compliance with various Federal, State, and international laws.
• Audit existing and legacy vendor agreements to update or insert appropriate data privacy protection for the Company.
• Support cybersecurity and privacy -related aspects of contracts, including vendor risk, data security terms, and regulatory compliance.
• Collaborate with business and product counsel to embed security-by-design and privacy-by-design principles across the enterprise.
• Engage with regulators and industry bodies on privacy and cybersecurity initiatives and compliance matters.

Qualifications

What we are looking for:

Demonstrated expertise in privacy and cybersecurity law is required. J.D. degree and admission to practice law in at least one U.S. jurisdiction strongly preferred.

Industry-recognized privacy and security certifications, such as CIPP, CIPM, CIPT, CISSP, or CISM, are strongly preferred.

Additional graduate-level study or specialized training in privacy, data protection, information governance, cybersecurity, or artificial intelligence governance is a plus.

3+ years of legal or equivalent privacy-related experience, with a strong focus on privacy, cybersecurity, information security, or technology law.

Familiarity with widely accepted cybersecurity standards and frameworks, such as NIST’s Cybersecurity Framework or ISO 27002.

Solid understanding of privacy principles, frameworks and laws, with a focus on North American, United Kingdom and EU privacy law and regulations.

Experience negotiating cybersecurity and data governance terms in contracts with vendors and clients.

Experience advising on cybersecurity and privacy issues in complex, regulated environments is preferred.

Strong communication skills with the ability to translate technical issues into clear legal guidance and the ability to translate legal guidance into actionable requirements.

Proficient with Microsoft suite tools, including all tools within Office365.

Collaborative mindset and ability to work across diverse teams and cultures.

A proactive, solutions-oriented approach and willingness to challenge the status quo.

International legal and privacy experience is preferred.

Compensation:

The base salary range for this position is $150,000.00 - $175,000.00.

Benefits:

For full-time employees, Xanterra offers a comprehensive benefits package including: Medical, Dental & Vision; HSA & FSA; Life & Disability; Accident, Hospital & Critical Illness; Pet Insurance; PTO and paid Holidays; 401(k) with Company Match; Employee Assistance Plan; Education Assistance; RTD-Denver transit pass for in-office employees, and Employee Discounts & Travel Deals.

Xanterra Travel Collection is committed to a diverse and inclusive workplace. We are an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, pregnancy, genetic information, protected veteran status, or any other legally protected status.