Incident Response Lead Counsel

Discover your future at Citi

Working at Citi is far more than just a job. A career with us means joining a team of more than 230,000 dedicated people from around the globe. At Citi, you’ll have the opportunity to grow your career, give back to your community and make a real impact.

Job Overview

The Incident Response Counsel (Lead Counsel 2) is a senior level position responsible for providing Citi businesses and functions, including technology teams, with integrated legal support, advice, and guidance on privacy matters with a particular focus on incident response across Citi globally.  The role will be under the supervision of the Global Privacy Legal Group Manager and will coordinate closely with the Cybersecurity Legal team and the broader Technology, Operations, & Privacy Legal Team.

This role requires a pragmatic, proactive attorney with thorough understanding of privacy and data protection, particularly in the context of a global regulated financial services institution, combined with a solid substantive, conceptual, and practical grounding in compliance with the applicable laws, rules and regulations for the geographies in which Citi operates. The role will provide input into strategic and operational decisions and exercise sound judgment to develop proactive and risk-appropriate, and business-focused solutions.

Responsibilities:

• Working with the Privacy Legal Team, Cybersecurity Legal Team, and business colleagues on reviewing and responding to potential data privacy incidents, including data privacy analysis within cybersecurity incidents, to ensure a consistent, efficient and effective approach across jurisdictions in compliance with applicable privacy and security standards, laws, rules and regulations.
• Collaborating with in-country, business and function Legal teams to drive high quality, consistent, compliant and efficient incident response advice globally.
• Working with the Privacy Legal Team and Cybersecurity Legal Team to support internal stakeholders on all aspects of incident prevention and response in data privacy events, including investigations, customer and regulatory notifications, contractual obligations, and legal risk mitigation.
• Developing, implementing and engaging in ongoing enhancements of Legal playbooks, checklists, decision trees, process flows, toolkits, template documentation (including notification letters) and training for members of the Legal teams engaged on privacy incidents to help drive high quality, accurate, efficient, well documented, consistent and actionable legal analysis and advice around privacy incidents globally.
• Reviewing facts, relevant laws, rules and regulations, and applicable legal analysis to ensure that consideration has been given to all appropriate factors in identifying and assessing the need to make, and the manner of making, individual, regulatory and/or contractual notifications concerning data privacy and/or information security events, and supporting stakeholders’ implementation of Legal’s recommendations.
• Supporting and using technologies and software to assist in the handling, analysis, documentation and resolution of incidents.
• Escalating matters, as appropriate, to support legal and compliance risk identification and mitigation and company requirements.
• Developing, and engaging in ongoing reviews of, metrics to help validate legal sufficiency, accuracy and consistency of recommendations and timeliness (e.g., trend analysis and lessons learned, and identifying any process improvements needed).
• Working with and supervising outside counsel, as needed.
• Assisting with other projects within the Technology, Operations & Privacy Legal team as requested and when time permits.

Qualifications:

• An attorney with minimum of five (5) years’ experience, three (3) years of which should be related to advising clients on privacy issues or incident response. Exceptional candidates with the necessary skill set may be eligible to be considered for the role, regardless of their level of experience.
• Knowledge of privacy and data protection laws, rules regulations, and practices, particularly around privacy incident response, as well as the regulatory and legal environment in which Citi operates.
• Proven background in privacy incident response, including investigations, notification determinations, compliance assessments, deploying industry-leading technologies and software solutions, and assisting with remediation and communication matters.
• Experience working with international teams in various time zones in a cross-functional multi-stakeholder environment.
• Self-starter with proven ability to apply sound judgment, engage directly with internal clients, manage multiple significant projects, and work well under tight time pressures.  The candidate should be willing to work outside of normal business hours during emergency events.
• Excellent interpersonal, organizational, project management, prioritization, decision-making, and relationship management skills, and the ability to build and maintain trusted relationships.
• Strong verbal and written communication skills with the ability to interface with all levels of the organization.
• Excellent research and analytical skills. Strong documentation, presentation, and communication skills in a cross-functional and global role.
• Highly responsive and client relationship focused.
• Excellent attention to detail and strong and practical problem-solving abilities to deal with unforeseen events.
• Experience in successfully navigating ambiguity and fluid organizational structures.
• The candidate preferably should have experience working in or with global financial institutions.
• CIPP and/or other data privacy certifications is preferred.
• Ability to work independently with minimal supervision in a fast-paced and high-volume practice, prioritize competing demands, and problem solve creatively.

Education:

• Juris Doctorate or equivalent law degree

------------------------------------------------------

Job Family Group:

Legal

------------------------------------------------------

Job Family:

Legal - Enterprise

------------------------------------------------------

Time Type:

Full time

------------------------------------------------------

Primary Location:

Tampa Florida United States

------------------------------------------------------

Primary Location Full Time Salary Range:

$140,640.00 - $210,960.00

In addition to salary, Citi’s offerings may also include, for eligible employees, discretionary and formulaic incentive and retention awards. Citi offers competitive employee benefits, including: medical, dental & vision coverage; 401(k); life, accident, and disability insurance; and wellness programs. Citi also offers paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays. For additional information regarding Citi employee benefits, please visit citibenefits.com. Available offerings may vary by jurisdiction, job level, and date of hire.

------------------------------------------------------

Most Relevant Skills

Please see the requirements listed above.

------------------------------------------------------

Other Relevant Skills

For complementary skills, please see above and/or contact the recruiter.

------------------------------------------------------

Anticipated Posting Close Date:

Sep 11, 2025

------------------------------------------------------

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.

If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.

View Citi’s EEO Policy Statement and the Know Your Rights poster.