Instructure is looking for an energetic attorney to lead its legal work in data privacy, security, and AI. This role involves supporting the company’s global privacy program, AI efforts, and security initiatives by helping create, implement, and maintain related policies and procedures, as well as managing daily legal, contractual, and regulatory issues involving data privacy, data protection, and AI. You will also partner with product, marketing, and engineering teams and manage a wide range of transactions, such as data processing agreements, vendor agreements, and transfer impact assessments. The ideal candidate is someone ready to dive into day‑to‑day work, bringing experience in privacy law within SaaS and tech environments and a solid understanding of business and transactional law.

What you will do:
• Provide in-house legal counsel to business and operational teams with a focus on privacy, security, and AI.
• Take the lead on legal issues related to privacy, security, and AI.
• Review and help develop data privacy policies and practices, identifying opportunities for improvement in partnership with the Privacy Office.
• Stay up to date on global privacy, security, data, and AI laws and standards and continue expanding your knowledge.
• Work closely with teams across the company—senior leadership, security, engineering, HR, marketing, compliance, and others—to advise on privacy, security, and AI matters, including global regulatory requirements and strategy.
• Collaborate with the Security Steering Committee to support the company’s data security incident processes, including tracking, investigating, and reporting incidents.
• Act as Instructure’s data protection officer under UK and EU GDPR.
• Support the Academic Office by representing the organization’s privacy interests with external groups, including government bodies involved in developing or revising privacy laws or standards.

What you need:
• Prior experience in global AI, data protection, and security law, with strong knowledge of U.S. and EU privacy regulations such as GDPR, FERPA, and U.S. consumer privacy laws.
• Strong business judgment, with the ability to evaluate legal risk while offering strategic, practical guidance.
• A J.D. from an accredited law school with strong academic performance.
• Four to six years of experience at a large firm, with some in‑house experience preferred.
• Excellent written and oral communication skills.
• Strong attention to detail and process accuracy.
• Ability to remain calm under pressure.
• Confidence to work directly with senior business leaders without supervision.
• Willingness to broaden responsibilities as needed as the company and role evolve.
• Significant experience in governance and operational incident response, including building and managing incident response programs that meet legal requirements, reporting obligations, and post-incident remediation.
• Experience advising cross‑functional teams (legal, security, GRC, product, engineering) on privacy matters across the organization, such as customer data handling, HR, and education-related issues.
• Excellent communication skills and experience presenting to boards, senior leadership, accountants, auditors, regulators, and other external stakeholders.
• Certifications such as CIPP (US and/or EU), CIPM, CIPT, or CISSP are highly valued.

We believe in hiring exceptional people and supporting them well. A diverse team leads to diverse thinking, which strengthens both our culture and our business.

Instructure participates in E‑Verify and is proud to be an Equal Opportunity Employer.

All Instructure employees must successfully pass a background check as a condition of employment.