Privacy and AI Governance Resources

Your role
As a Corporate Counsel, Product & Privacy, you'll be a trusted, largely independent legal advisor on how Dialpad's AI-powered products intersect with privacy, security, customer protection, and related regulatory obligations. You'll work closely with Product, Engineering, Security, Marketing, Sales, and Customer Success to embed legal judgment directly into how our products are designed, launched, and scaled. You'll help build the frameworks, playbooks, and guardrails that keep Dialpad a trustworthy, enterprise-ready AI platform, and find creative, practical solutions for novel legal questions where no template exists.

This position reports to our Deputy General Counsel and may be based in our San Francisco, CA (preferred) office. You'll join a collaborative legal team alongside dedicated product, privacy, and telecom legal resources, supported by a strong network of outside counsel and cross-functional partners.

What you'll do

• AI governance & product counseling – Advise Product and Engineering on privacy-by-design and AI governance considerations across the product lifecycle. Help build and maintain legal frameworks covering AI training data, LLM data use, model governance, and compliance with the EU AI Act, US state AI laws, and FTC guidance.
• Global privacy & data protection – Support Dialpad's global privacy program (GDPR/UK GDPR, CCPA/CPRA, HIPAA, and biometric privacy laws including BIPA and relevant state voice/voiceprint statutes). Own day-to-day administration of the data subject access request program, maintain DPIAs and RoPAs, support cross-border transfer mechanisms (SCCs, UK IDTA, EU-US DPF), and serve as on-call counsel for data incidents, including breach response and required notifications.
• Telecom & regulatory coordination – Partner with Dialpad's Telecommunications & Regulatory Counsel on call-recording and consent issues that intersect with product features (transcription, AI notetaking, real-time coaching) and on CIPA/wiretap-adjacent product questions. Stay conversant in FCC/TCPA/911/USF fundamentals to spot issues early and route them to the right owner, without holding primary responsibility for telecom regulatory strategy.
• Security partnerships & certifications – Partner with Security and GRC on certifications (ISO 27001, SOC 2, PCI, HIPAA) and help design privacy-enhancing controls, including automated redaction, anonymization, and access governance.
• Commercial & marketing enablement – Support DPA and BAA negotiations, advise Sales on privacy- and product-related contract terms, and counsel Marketing on TCPA, CIPA, web tracking, consent signals, and digital advertising compliance.
• IP & legal operations – Participate in the Patent Review Board, support litigation holds and records-retention practices, contribute to internal policies, and help build resources that turn complex regulations into practical, usable guidance for the business.

Skills you'll bring

• J.D. from an ABA-accredited law school; license in good standing to practice law in at least one U.S. state.
• 5–8 years of substantive privacy, product-counseling, and regulatory experience, ideally including time at a law firm with a technology or privacy practice plus in-house experience at a SaaS or technology company.
• Working knowledge of GDPR, CCPA/CPRA, and HIPAA, including privacy-by-design principles and cross-border data transfer mechanisms.
• Familiarity with AI legal frameworks (EU AI Act, US state AI legislation, FTC priorities) and demonstrated interest in developing deeper expertise as the landscape evolves.
• Experience advising Product and Engineering teams directly, including translating complex legal requirements into clear, actionable guidance for non-legal audiences.
• Some exposure to FCC/TCPA/VoIP regulation, call recording, or telecom/voice-AI compliance is a plus, though this role is not expected to own telecom regulatory strategy.
• Experience supporting incident response and breach notification under U.S. state laws and/or GDPR.
• CIPP/US, CIPP/E, or equivalent privacy certification is a plus.

The Challenge

AI Governance is one of the fastest-emerging categories in enterprise software. The first Gartner® Magic Quadrant™ for AI Governance Platforms was published this year, and OneTrust is named a Visionary in it.

OneTrust is looking for a Principal Product Manager to own the developer-facing products in our AI Governance solution to own it’s early success and growing adoption.

These products live within the AI development lifecycle an engineer already follows when it builds an AI system: writing prompts, wiring up retrieval and tools, evaluating what the system actually does, and deciding it is ready to ship. You own the governance tooling and checks that live at those steps, and the work is to turn governance requirements into controls a developer can implement and test.

You will define what we build, ship it with a dedicated engineering and design team, and prove it with measurable outcomes. You will work daily with Engineering, UX, and other Product Managers, and you will prototype and build with modern AI development tools.

Your Mission

• Define and own the product strategy, roadmap, and packaging for OneTrust's developer-facing AI governance products
• Translate governance requirements into technical requirements, tests, and controls that developers can act on
• Own the developer experience end to end, including SDK design, APIs, documentation, samples, and CI/CD integration
• Set requirements earlier in the lifecycle carry into the build, and that signals from production carry back into future evaluations
• Work with design partners and early access customers to validate direction against real engineering teams
• Partner with Product Marketing, Sales Engineering, on positioning, launches, and the technical narrative
• Own the outcomes: developer adoption, integration depth, and the revenue and retention these products influence

You Are

A hands-on product leader with a track record of strong product ownership and demonstrated product-led growth. You have shipped developer-facing products, and you are comfortable with ambiguity. You work well at speed, building for where the market is right now and revising as it moves.

• Builder — You prototype. When a team is deciding on an API shape or an interaction, you open the tools and show them one. You are comfortable in a repo and an SDK.
• Developer empathy — You have built products where the user was an engineer, and you know adoption is won on time-to-first-integration, documentation, and good defaults.
• Collaborator — Most of what you own depends on work other teams are doing, and you spend as much time inside their plans as your own. You build alignment and confidence across other teams without having authority over them.
• Zero-to-one — You have taken new products from nothing to real customers and real revenue, knowing full well what it takes.

Your Experience Includes

• Bachelor's degree in Computer Science, Engineering, or a related technical field, or equivalent practical experience
• 12+ years of product management experience in enterprise software, including end-to-end ownership of a technical product area
• Demonstrated success taking new products from concept to shipped, adopted, and generating revenue
• Strong working knowledge of the modern AI stack: LLMs and model providers, agents and tool calling, RAG pipelines, prompts, and their failure modes
• Familiarity with AI evaluation practice, including benchmarking, offline and online evaluation, red teaming, and safety testing
• Proven ability to partner deeply with Engineering, UX, Security, and Legal, and to earn technical credibility with senior engineers
• Exceptional communication skills with the ability to articulate vision, create alignment, and represent new products credibly

A major plus:

• Experience building developer tools or developer platforms — SDKs, APIs, CLIs, IDE extensions, CI/CD integrations, or testing frameworks — where engineers were your primary user
• Fluency using AI tools to build product: prototyping in code with coding agents, building your own evals, and shipping AI-assisted workflows

Also preferred:

• Hands-on experience with AI security or safety controls such as guardrails, prompt injection defenses, content filtering, or output validation
• Familiarity with AI regulations and frameworks such as the EU AI Act, NIST AI RMF, and ISO 42001
• Experience with design partner programs, early access programs, or developer relations

Are you ready to get the Easygo Edge?

We're looking for a Privacy Manager to own and mature Easygo's privacy programme across our global markets. This is a role with genuine ownership, building the framework from the inside rather than advising from the sidelines. You'll report directly to the General Counsel, with plenty of runway as the function takes shape.

What you’ll build with us:
At our scale, privacy carries serious weight. Expect to be the day to day point of contact across the group, translating regulatory obligations into practical controls and advice for product, engineering, data and marketing. The challenge is bridging the evolving privacy and data protection landscape with operational reality, helping quick moving teams build compliant systems without slowing the pace of innovation Easygo is known for.

We know that innovation ignites when we build and create together, in person. This is a full-time opportunity at our Melbourne office. You’ll work right where it all happens, surrounded by our fearless crew shipping high-impact work.

Who is Easygo?
We’re a high-growth, high-velocity tech company with millions of eyeballs on us every day. We’re building the future of fearless tech.

We’re the creators behind some of the most popular brands including Stake, KICK and Easygo Games. While they command a fierce global following, our crew is employed directly by Easygo and that’s where the real fun happens.

We’re always looking for people who are hungry, humble and move fast. People who are ready to Unify, Disrupt and Evolve with us.

With us you’ll grow faster and go further. Your work has impact. And that gives you an edge you can’t get anywhere else.

The impact you’ll make:

• Own, maintain and mature Easygo's global privacy framework, including policies, standards, procedures, controls and a privacy roadmap across all brands and jurisdictions
• Monitor and interpret developments in applicable privacy regimes, translating them into practical, prioritised business requirements
• Design and run privacy impact assessments and drive the embedding of a privacy by design approach into the product development lifecycle for new products, features, vendors, AI initiatives and data uses
• Assess the privacy risk of vendors, processors, affiliates and commercial partners, and manage data processing agreements, standard contractual clauses and other cross border transfer mechanisms
• Provide timely, practical and commercially grounded privacy advice to product, engineering, security, data, marketing and customer operations teams, and design and deliver privacy training and awareness across the business
• Report on privacy risk, metrics, incidents and remediation progress to Legal leadership and relevant risk and governance forums, and support internal and external audits, certifications and regulatory enquiries

Your track record:

• A tertiary qualification in law, information governance, risk, compliance or a related discipline
• 5+ years in a dedicated privacy or data protection role, in house or in professional services, including hands on ownership of a privacy programme in a multi jurisdictional organisation handling large volumes of personal information
• Working knowledge of the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Notifiable Data Breaches scheme, together with the EU and UK GDPR
• A sound working understanding of modern technology stacks, cloud infrastructure, data analytics and artificial intelligence, and the privacy issues each raises
• Excellent written and verbal English communication skills, with the ability to translate complex privacy and legal requirements for technical and commercial audiences, and to influence outcomes without direct authority
• Experience managing multiple workstreams simultaneously, prioritising tasks effectively and meeting tight deadlines in a fast paced environment, with strong organisational skills and the ability to work autonomously

Bonus points if you also have:

• A recognised privacy certification such as CIPP/E, CIPP/US, CIPM or FIP
• A legal background or admission to practice (not required, but welcome)
• Familiarity with North American privacy regimes, including state based comprehensive privacy laws
• Familiarity with online gambling regulation, including the interaction between privacy obligations and AML/CTF, know your customer and responsible gambling data requirements, and/or the livestreaming landscape

Here are our benefits and perks:

Sharpening your edge

• The ultimate sandbox. Exciting, on-the-job learning opportunities.
• 1 in 3 of our people level up their roles every year. If you deliver, you move.

Competitive pay and bonus scheme

• Market-synced pay that respects your craft and location.
• Performance-based bonus recognition based on your impact (up to 20%).
• Help us build our crew and get paid for it with our high-value referral bonus. Because great people know great people.

Other perks

• 18 weeks paid parental leave for primary carers
• Smooth Parental Return: Ease back into work with 12 weeks of transition support, including fully paid Fridays off during your first three months back
• Access to Employee Assistance Program
• Wednesday massages
• In-house baristas serve you free coffee, fresh juices and smoothies.
• Daily catered breakfast and regular company-wide events.
• Snack walls and drink fridges on every floor.
• Fun, modern office spaces. Pool tables, table tennis, gaming consoles and an F1 simulator.

We play fair. We hire fair.

True to our value of ‘Play fair’ we always hire fair. Our work and our brands are fuelled by our diverse culture. We hire for talent and grit. But we never discriminate. Your race, religion, nationality, gender identity or expression, sexual orientation, age, marital, veteran, or disability status won’t affect our hiring decision, or your trajectory here. Come as you are and get the Easygo edge.

Key Responsibilities

• Serve as the main point of contact for sales and customer teams regarding security, privacy, and compliance topics, communicating with customers and prospects through RFPs, emails, or calls.

• Review customer/prospect questionnaires and security addendums, providing and building necessary information, collaterals, and resources.

• Maintain information security reports, RFP knowledgebase, and security assets for the security due diligence process utilizing existing RFP management tools.

• Work flexibly across all teams in the organization, driving security RFP and third-party risk management projects, including sales, customer success, product, and engineering.

• Own the third-party risk management process, including planning, scoping, needs analysis, ongoing project management, and communication with stakeholders.

• Conduct security due diligence on new third parties and perform periodic risk reviews of existing third parties.

• Own and manage controls across SOC 2 Type II, ISO standards, 21 CFR Part 11, and HIPAA frameworks, maintaining an up-to-date control landscape and evidence inventory.

• Coordinate and support external audits end-to-end - from audit scoping and evidence preparation to auditor walkthroughs and post-audit remediation tracking.

• Manage compliance tracking across Google Workspace (Sheets, Drive, Docs, Gmail) - maintaining structured control registers, evidence repositories, and policy documentation.

• Send and track corrective action communications to control owners, following up through resolution and maintaining a clear audit trail.

• Conduct periodic internal compliance reviews and produce structured reports for leadership.

• Collaborate closely with privacy, internal governance, audit, Engineering, DevOps, Legal, and HR teams to gather necessary information related to compliance and ensure controls are implemented.

• Work with engineering, business applications, legal, and other teams as required to fulfill customer, prospect, or third-party compliance requirements.

• Maintain and periodically review information security policies, procedures, and standards in Google Docs, ensuring they remain current and aligned with framework controls.

• Coordinate access reviews, vendor security assessments, and third-party risk evaluations as part of the ongoing compliance calendar.

• Undertake any other reasonable and related tasks associated with the role.

Requirements

Experience and Background

• 3-5 years of experience in information security and compliance, with exposure to cloud software platforms (AWS/GCP).

• Extensive experience in handling customer security queries, including RFPs, questionnaires, security architecture reviews, and data protection evaluations.

• Experience in managing third-party risk evaluation and management processes.

• Strong understanding of cloud governance and technology security controls covered in SOC 2, ISO Standards, NIST, GDPR, HIPAA, CSA STAR, CIS, etc.

Tooling and Workflow

• Proficient in Google Workspace - comfortable using Sheets for control tracking, Drive and Docs for policy and evidence management, Gmail for formal communications, and Calendar for scheduling.

• Utilize existing RFP management tools to maintain the knowledge base in line with changing customer needs, global standards, product releases, and updates.

• Experience using Jira for cross-functional issue tracking and Slack for team collaboration.

Soft Skills and Working Style

• Excellent communication, interpersonal, project management, and issue-resolution skills.

• Strong written communication skills - able to draft clear policy documents, corrective action notices, and executive summaries.

• Strong analytical and organizational skills, with the ability to work effectively as part of a team.

• Proactive, pragmatic, and self-driven - able to learn quickly, take initiative, identify gaps, propose solutions, and drive complex projects in a fast-paced SaaS environment.

Good to have:

• Certifications: CISSP, CISM, CISA, CRISC, CCSP,  ISO 27001, ISO 42001, ISO 22301, CompTIA Security+, etc.

• Understanding of data privacy principles under GDPR and HIPAA, including data classification, retention policies, and subject rights processes.

Jala University is an innovative initiative designed to bridge the gap between academia and industry by delivering practical education tailored to industry needs, with a unique educational model integrating experts from both academia and industry.

Our goal is to transform the economies of underserved regions through the software industry, creating professional opportunities that impact individuals, communities, and regions, while leaving a lasting legacy for future generations

Requirements

• 5+ years of relevant professional experience, with an applied track record in AI compliance/governance.
• Can build their portion of the artifact personally, to production standard — the compliance-mapping section is a deliverable, not a legal opinion handed to someone else to implement.
• Public track record of explaining technical or regulatory work in writing.
• Documentation discipline — versioned templates, traceability of every compliance decision.
• Professional written English — the language of instruction for the program.

AI governance/compliance specialist with experience applying real regulatory frameworks to a concrete technical case — not just abstract legal knowledge. Must be able to work shoulder to shoulder with a technical architect and translate regulatory requirements into actionable design constraints.

Reference frameworks

EU AI Act, MX LFPDPPP-2025, BR LGPD and Bill 2338/2023, CO CONPES 4144 — or an equivalent set covering the EU AI Act plus at least two LatAm regimes.

Benefits

• Remote work modality (home office).
• Joining a dynamic and growing organization with international reach.