Product Counsel, Data & Privacy (Fintech)

Location: Hybrid in New York City or San Francisco, United States

Compensation: $200,000–$250,000 plus equity

Company

hirify.global builds co-branded credit-card and embedded payments programs using payments infrastructure, underwriting, and customer data for brands and their customers.

What you will do

• Serve as the first-line legal advisor on partner data sharing, including customer, account, and application data shared through integrations and offline feeds.
• Advise on privacy opt-outs, suppression obligations, data retention, deletion, privacy notices, and cardholder information-sharing notices.
• Provide practical guidance on FCRA, GLBA/Regulation P, state privacy laws, automated decision-making, AI requirements, credit scoring, and product design.
• Partner with Security and GRC on vendor risk assessments, data protection, testing constraints, incident response, forensics, chain of custody, and breach notifications.
• Counsel Product and Engineering on features affecting data sharing, privacy, and customer experience; draft consents, data terms, data-sharing agreements, DPAs, and regulatory documentation.
• Coordinate with Compliance on regulatory interpretation, monitoring, exam preparation, escalated complaints, regulatory inquiries, and bank-partner matters.

Requirements

• J.D. from an accredited law school and active membership in good standing with at least one U.S. state bar.
• 4–8 years of experience in data privacy law, including expertise in GLBA/Regulation P, FCRA, CCPA, and consumer financial regulation.
• Experience in financial services, fintech, or a high-growth startup environment.
• Working knowledge of FCRA and GLBA/Regulation P and practical familiarity with CCPA/CPRA and newer state privacy regimes.
• Experience advising on data-sharing arrangements, privacy notices, opt-outs, and data retention.
• Strong contract review skills covering data-sharing agreements, DPAs, and regulatory-facing documentation.
• Experience partnering with security and information-security teams on vendor risk assessments, data protection, and incident response.
• Ability to work autonomously, own work end-to-end, manage competing priorities, and deliver clear guidance under tight timelines.
• Strong communication, stakeholder-management, independent research, and cross-functional relationship-building skills.

Nice to have

• Privacy certification such as CIPP/US.
• Experience with FCRA in lending or credit, ECOA/Reg B adverse action, automated decision-making, or AI governance.
• Familiarity with PCI DSS, SOC 2, NIST, breach response, and incident-response processes.
• Knowledge of TILA/Reg Z, EFTA/Reg E, UDAAP, CAN-SPAM, TCPA, GDPR applicability, and ROPA obligations.
• Experience with sponsor banks, banking-as-a-service, fintech partnerships, consumer credit products, credit cards, or buy-now-pay-later products.
• Experience with ticketing or project-management systems such as Linear, Jira, or Asana.
• Comfort with legal technology, AI-assisted workflows, process automation, and standardizing privacy frameworks across product lines or partner programs.

Culture & Benefits

• Hybrid work in New York City or San Francisco.
• Competitive compensation and equity package.
• Configured work computer of choice and access to technology across business units.
• Flexible paid time off.
• Fully covered healthcare, including dependent coverage, plus One Medical and an FSA option.
• 20 weeks of paid parental leave for the primary caregiver and 8 weeks for all new parents.