Privacy & Commercial Counsel (SaaS/Privacy)

TL;DR

Privacy & Commercial Counsel (SaaS/Privacy): Managing the commercial privacy workstream including DPA negotiations and regulatory compliance for a global API platform with an accent on translating complex privacy frameworks into operational contract language. Focus on balancing legal precision with deal momentum, managing high-volume privacy questionnaires, and advising go-to-market teams.

Location: Must be based in San Francisco, California. In-office 5 days a week.

Salary: $190,000–$230,000 base + equity package.

Company

Postman is the world's leading API platform used by over 45 million developers and 98% of the Fortune 500 to simplify the API lifecycle.

What you will do

• Serve as the primary legal resource for privacy questions in commercial transactions, including enterprise deals, vendor agreements, and partner contracts.
• Draft, review, and negotiate data processing agreements (DPAs) and data protection addenda on company and counterparty paper.
• Manage high volumes of customer and prospect privacy and security questionnaires and due diligence requests.
• Advise Sales, Deal Operations, and Partner teams on GDPR, UK GDPR, CCPA/CPRA, and international data transfer mechanisms.
• Maintain and update DPA templates, negotiation playbooks, and create self-serve resources for the GTM team.
• Support broader commercial deal pipeline, including reviewing subscription agreements and order forms as capacity allows.

Requirements

• J.D. from an accredited U.S. law school and admission to the bar in at least one U.S. jurisdiction.
• 5-8 years of legal experience focusing on data privacy and commercial transactions, including substantial in-house tech experience.
• Deep working knowledge of GDPR, UK GDPR, CCPA/CPRA, and international data transfer mechanisms (SCCs, UK Addendum).
• Hands-on experience drafting and negotiating DPAs in the context of enterprise SaaS transactions.
• Ability to simplify complex privacy regulations for non-legal stakeholders without sacrificing accuracy.
• Experience using AI tools applied to legal workflows (contract review, research, drafting).

Nice to have

• CIPP/US, CIPP/E, or CIPM certification.
• Knowledge of global privacy frameworks such as LGPD (Brazil), PIPL (China), PIPA (South Korea), APPI (Japan), or PDPA (Singapore).
• Experience drafting and negotiating Business Associate Agreements (BAAs) under HIPAA.
• Familiarity with SOC 2, ISO 27001, or CLM platforms like Ironclad.
• Experience with privacy aspects of AI-related products, including model training and AI governance frameworks.

Culture & Benefits

• Comprehensive medical coverage, flexible PTO, and wellness reimbursement.
• Monthly lunch stipend and frequent team-building events.
• Donation-matching program to support various causes.
• Inclusive culture based on transparency, honest communication, and pay-on-performance philosophy.
• Collaborative in-person work environment at company hubs.