Security Researcher

The Legal Counsel II, Privacy & Data Protection will provide practical, business-oriented legal advice on U.S. and global privacy matters across Nielsen’s products, services, commercial relationships, and internal operations. This role will support the development and operation of Nielsen’s privacy program and partner closely with Product, Engineering, Data Science, Information Security, Procurement, Sales, Marketing, and other business teams.

Advise on privacy compliance, data governance, and risk mitigation for business operations, products, data partnerships, and commercial transactions.
Apply expanded knowledge and experience in privacy and data protection law while continuing to develop higher-level expertise.
Solve a range of privacy and commercial legal problems using sound judgment, established frameworks, and practical business analysis.
Draft, review and negotiate complex data protection exhibits on both the buy-side and sell-side.
Receive moderate guidance and direction while taking ownership of assigned matters and workstreams.

Responsibilities

Provide day-to-day legal guidance on U.S. federal and state privacy laws, including the CCPA/CPRA and the evolving patchwork of comprehensive state privacy statutes, as well as applicable sectoral, consumer protection, marketing, and data security requirements.
Maintain an in-depth working knowledge of U.S. state privacy regulations and translate legal developments into clear, actionable guidance, contract language, policies, notices, processes, and implementation requirements.
Draft, review, and negotiate data processing agreements (DPAs), data protection and security terms, data use and sharing agreements, and related privacy provisions in commercial contracts, representing Nielsen both as a data buyer/customer and as a data seller, provider, or service provider.
Conduct and support privacy impact assessments (PIAs/DPIAs) for products, features, data uses, partnerships, and other initiatives; identify risks, recommend mitigations, and help embed privacy by design and by default.
Conduct privacy due diligence on third parties, vendors, customers, and strategic partners, including reviewing questionnaires and security materials, assessing processing activities and data flows, identifying gaps, negotiating remediation, and supporting ongoing oversight.
Advise on advertising technology, audience measurement, analytics, identity, cookies, pixels, SDKs, targeted advertising, consent and preference management, data monetization, and related media and marketing data practices. Experience in adtech is strongly preferred.
Partner with Product, Engineering, Data Science, Information Security, Procurement, Sales, Marketing, and other stakeholders to assess proposed data collection, use, disclosure, retention, and deletion activities and to support compliant launches and operational changes.
Support privacy incident and data breach response, consumer and data subject rights escalations, regulatory inquiries, audits, and other privacy compliance matters in coordination with relevant internal teams and outside counsel.
Contribute to privacy program materials, including policies, procedures, playbooks, templates, training, records of processing, data inventories, and compliance reporting.
Monitor changes in privacy and data protection laws and enforcement trends, assess their impact on Nielsen’s business, and communicate concise recommendations to stakeholders.
Manage multiple priorities in a fast-paced, global environment and provide clear, timely, and pragmatic advice to both legal and non-legal audiences.

Role-Level Expectations

Understands key business drivers and uses this understanding to accomplish assigned work.
Solves standard and moderately complex problems by analyzing possible solutions using experience, judgment, and precedent.
Has no supervisory responsibilities but may provide guidance to new associates or colleagues.
Explains privacy and legal information to others in straightforward and actionable terms.
Requires expanded conceptual knowledge in privacy and data protection while developing additional skill sets.
Impacts the quality of own work and the work of the team while operating within applicable guidelines and policies.

2 - 5 years of experience practicing privacy, data protection, technology, commercial, or related legal work, preferably in-house or in a law firm advising technology, media, advertising, data, or analytics businesses.
J.D. or equivalent legal qualification and admission to at least one U.S. state bar, consistent with the requirements for the role.
At least 2 years of experience with U.S. state privacy regulations, including the CCPA/CPRA and other comprehensive state privacy laws, with the ability to interpret requirements and operationalize them across products, contracts, and business processes.
At least 2 years of experience with demonstrated experience conducting or supporting DPIAs/PIAs and privacy risk assessments, including documenting risks and tracking mitigation measures.
Demonstrated experience drafting, reviewing, and negotiating DPAs and other privacy-related contract terms, including experience advising both buyers/customers and sellers/providers of data or services.
Strong legal research, writing, negotiation, analytical, and issue-spotting skills, with the ability to explain complex privacy requirements in clear business terms.
Ability to work collaboratively with cross-functional and international teams, exercise sound judgment, manage competing priorities, and operate effectively with moderate supervision.

Preferred Qualifications

Knowledge of APAC privacy and data protection regulations -particularly India’s Digital Personal Data Protection framework, Australia’s Privacy Act and Australian Privacy Principles, or South Korea’s Personal Information Protection Act - greatly preferred, but it is not a hard requirement.
CIPP/US certification is a significant advantage.
Adtech, Martech, media measurement, audience analytics, data licensing, or digital advertising experience is strongly preferred.
Familiarity with the GDPR/UK GDPR, international data transfers, cross-border data sharing, and related contractual mechanisms.
Familiarity with consent and preference management, IAB frameworks such as the Global Privacy Platform or Transparency and Consent Framework, privacy management tools, data mapping, and records of processing activities.
Additional privacy certification, such as CIPM, CIPT, or an equivalent credential, is a plus.

Enabling your best to power a better media future.

Holistic Rewards: We are committed to an inclusive benefits package that supports our employees and their families. This includes comprehensive health and wellness plans, a 401(k) with a Nielsen company match, and a generous paid time off policy. Depending on the role, additional benefits may include a company-provided vehicle and/or discretionary incentive/bonus eligibility.

Compensation Transparency: The posted base salary range is a reasonable estimate that may be adjusted based on the final work location of the selected employee. Individual pay within the range is determined by factors such as experience, training, geography, certifications, and business needs. Beyond base salary, this role may be eligible for bonuses, equity, or other incentives.

Nielsen makes hiring decisions without regard to disability status, protected veteran status, or membership in any other protected class.

Please be aware that job-seekers may be at risk of targeting by scammers seeking personal data or money. Nielsen recruiters will only contact you through official job boards, LinkedIn, or email with a domain. Be cautious of any outreach claiming to be from Nielsen via other messaging platforms or personal email addresses. Always verify that email communications come from an @ address. If you're unsure about the authenticity of a job offer or communication, please contact Nielsen directly through our official website or verified social media channels.

At Nielsen, we are passionate about our work to power a better media future for all people by providing powerful insights that drive client decisions and deliver extraordinary results. Our talented, global workforce is dedicated to capturing audience engagement with content - wherever and whenever it’s consumed. Together, we are proudly rooted in our deep legacy as we stand at the forefront of the media revolution. When you join Nielsen, you will join a dynamic team committed to excellence, perseverance, and the ambition to make an impact together. We champion you, because when you succeed, we do too. We enable your best to power our future.

Originally posted on Himalayas

Job Description

Advise on privacy compliance, data governance, and risk mitigation for business operations, products, data partnerships, and commercial transactions.
Apply expanded knowledge and experience in privacy and data protection law while continuing to develop higher-level expertise.
Solve a range of privacy and commercial legal problems using sound judgment, established frameworks, and practical business analysis.
Draft, review and negotiate complex data protection exhibits on both the buy-side and sell-side.
Receive moderate guidance and direction while taking ownership of assigned matters and workstreams.

Responsibilities

Provide day-to-day legal guidance on U.S. federal and state privacy laws, including the CCPA/CPRA and the evolving patchwork of comprehensive state privacy statutes, as well as applicable sectoral, consumer protection, marketing, and data security requirements.
Maintain an in-depth working knowledge of U.S. state privacy regulations and translate legal developments into clear, actionable guidance, contract language, policies, notices, processes, and implementation requirements.
Draft, review, and negotiate data processing agreements (DPAs), data protection and security terms, data use and sharing agreements, and related privacy provisions in commercial contracts, representing Nielsen both as a data buyer/customer and as a data seller, provider, or service provider.
Conduct and support privacy impact assessments (PIAs/DPIAs) for products, features, data uses, partnerships, and other initiatives; identify risks, recommend mitigations, and help embed privacy by design and by default.
Conduct privacy due diligence on third parties, vendors, customers, and strategic partners, including reviewing questionnaires and security materials, assessing processing activities and data flows, identifying gaps, negotiating remediation, and supporting ongoing oversight.
Advise on advertising technology, audience measurement, analytics, identity, cookies, pixels, SDKs, targeted advertising, consent and preference management, data monetization, and related media and marketing data practices. Experience in adtech is strongly preferred.
Partner with Product, Engineering, Data Science, Information Security, Procurement, Sales, Marketing, and other stakeholders to assess proposed data collection, use, disclosure, retention, and deletion activities and to support compliant launches and operational changes.
Support privacy incident and data breach response, consumer and data subject rights escalations, regulatory inquiries, audits, and other privacy compliance matters in coordination with relevant internal teams and outside counsel.
Contribute to privacy program materials, including policies, procedures, playbooks, templates, training, records of processing, data inventories, and compliance reporting.
Monitor changes in privacy and data protection laws and enforcement trends, assess their impact on Nielsen’s business, and communicate concise recommendations to stakeholders.
Manage multiple priorities in a fast-paced, global environment and provide clear, timely, and pragmatic advice to both legal and non-legal audiences.

Role-Level Expectations

Understands key business drivers and uses this understanding to accomplish assigned work.
Solves standard and moderately complex problems by analyzing possible solutions using experience, judgment, and precedent.
Has no supervisory responsibilities but may provide guidance to new associates or colleagues.
Explains privacy and legal information to others in straightforward and actionable terms.
Requires expanded conceptual knowledge in privacy and data protection while developing additional skill sets.
Impacts the quality of own work and the work of the team while operating within applicable guidelines and policies.

2 - 5 years of experience practicing privacy, data protection, technology, commercial, or related legal work, preferably in-house or in a law firm advising technology, media, advertising, data, or analytics businesses.
J.D. or equivalent legal qualification and admission to at least one U.S. state bar, consistent with the requirements for the role.
At least 2 years of experience with U.S. state privacy regulations, including the CCPA/CPRA and other comprehensive state privacy laws, with the ability to interpret requirements and operationalize them across products, contracts, and business processes.
At least 2 years of experience with demonstrated experience conducting or supporting DPIAs/PIAs and privacy risk assessments, including documenting risks and tracking mitigation measures.
Demonstrated experience drafting, reviewing, and negotiating DPAs and other privacy-related contract terms, including experience advising both buyers/customers and sellers/providers of data or services.
Strong legal research, writing, negotiation, analytical, and issue-spotting skills, with the ability to explain complex privacy requirements in clear business terms.
Ability to work collaboratively with cross-functional and international teams, exercise sound judgment, manage competing priorities, and operate effectively with moderate supervision.

Preferred Qualifications

Knowledge of APAC privacy and data protection regulations -particularly India’s Digital Personal Data Protection framework, Australia’s Privacy Act and Australian Privacy Principles, or South Korea’s Personal Information Protection Act - greatly preferred, but it is not a hard requirement.
CIPP/US certification is a significant advantage.
Adtech, Martech, media measurement, audience analytics, data licensing, or digital advertising experience is strongly preferred.
Familiarity with the GDPR/UK GDPR, international data transfers, cross-border data sharing, and related contractual mechanisms.
Familiarity with consent and preference management, IAB frameworks such as the Global Privacy Platform or Transparency and Consent Framework, privacy management tools, data mapping, and records of processing activities.
Additional privacy certification, such as CIPM, CIPT, or an equivalent credential, is a plus.

Enabling your best to power a better media future.

Nielsen makes hiring decisions without regard to disability status, protected veteran status, or membership in any other protected class.

Originally posted on Himalayas

Job Description

Advise on privacy compliance, data governance, and risk mitigation for business operations, products, data partnerships, and commercial transactions.
Apply expanded knowledge and experience in privacy and data protection law while continuing to develop higher-level expertise.
Solve a range of privacy and commercial legal problems using sound judgment, established frameworks, and practical business analysis.
Draft, review and negotiate complex data protection exhibits on both the buy-side and sell-side.
Receive moderate guidance and direction while taking ownership of assigned matters and workstreams.

Responsibilities

Provide day-to-day legal guidance on U.S. federal and state privacy laws, including the CCPA/CPRA and the evolving patchwork of comprehensive state privacy statutes, as well as applicable sectoral, consumer protection, marketing, and data security requirements.
Maintain an in-depth working knowledge of U.S. state privacy regulations and translate legal developments into clear, actionable guidance, contract language, policies, notices, processes, and implementation requirements.
Draft, review, and negotiate data processing agreements (DPAs), data protection and security terms, data use and sharing agreements, and related privacy provisions in commercial contracts, representing Nielsen both as a data buyer/customer and as a data seller, provider, or service provider.
Conduct and support privacy impact assessments (PIAs/DPIAs) for products, features, data uses, partnerships, and other initiatives; identify risks, recommend mitigations, and help embed privacy by design and by default.
Conduct privacy due diligence on third parties, vendors, customers, and strategic partners, including reviewing questionnaires and security materials, assessing processing activities and data flows, identifying gaps, negotiating remediation, and supporting ongoing oversight.
Advise on advertising technology, audience measurement, analytics, identity, cookies, pixels, SDKs, targeted advertising, consent and preference management, data monetization, and related media and marketing data practices. Experience in adtech is strongly preferred.
Partner with Product, Engineering, Data Science, Information Security, Procurement, Sales, Marketing, and other stakeholders to assess proposed data collection, use, disclosure, retention, and deletion activities and to support compliant launches and operational changes.
Support privacy incident and data breach response, consumer and data subject rights escalations, regulatory inquiries, audits, and other privacy compliance matters in coordination with relevant internal teams and outside counsel.
Contribute to privacy program materials, including policies, procedures, playbooks, templates, training, records of processing, data inventories, and compliance reporting.
Monitor changes in privacy and data protection laws and enforcement trends, assess their impact on Nielsen’s business, and communicate concise recommendations to stakeholders.
Manage multiple priorities in a fast-paced, global environment and provide clear, timely, and pragmatic advice to both legal and non-legal audiences.

Role-Level Expectations

Understands key business drivers and uses this understanding to accomplish assigned work.
Solves standard and moderately complex problems by analyzing possible solutions using experience, judgment, and precedent.
Has no supervisory responsibilities but may provide guidance to new associates or colleagues.
Explains privacy and legal information to others in straightforward and actionable terms.
Requires expanded conceptual knowledge in privacy and data protection while developing additional skill sets.
Impacts the quality of own work and the work of the team while operating within applicable guidelines and policies.

2 - 5 years of experience practicing privacy, data protection, technology, commercial, or related legal work, preferably in-house or in a law firm advising technology, media, advertising, data, or analytics businesses.
J.D. or equivalent legal qualification and admission to at least one U.S. state bar, consistent with the requirements for the role.
At least 2 years of experience with U.S. state privacy regulations, including the CCPA/CPRA and other comprehensive state privacy laws, with the ability to interpret requirements and operationalize them across products, contracts, and business processes.
At least 2 years of experience with demonstrated experience conducting or supporting DPIAs/PIAs and privacy risk assessments, including documenting risks and tracking mitigation measures.
Demonstrated experience drafting, reviewing, and negotiating DPAs and other privacy-related contract terms, including experience advising both buyers/customers and sellers/providers of data or services.
Strong legal research, writing, negotiation, analytical, and issue-spotting skills, with the ability to explain complex privacy requirements in clear business terms.
Ability to work collaboratively with cross-functional and international teams, exercise sound judgment, manage competing priorities, and operate effectively with moderate supervision.

Preferred Qualifications

Knowledge of APAC privacy and data protection regulations -particularly India’s Digital Personal Data Protection framework, Australia’s Privacy Act and Australian Privacy Principles, or South Korea’s Personal Information Protection Act - greatly preferred, but it is not a hard requirement.
CIPP/US certification is a significant advantage.
Adtech, Martech, media measurement, audience analytics, data licensing, or digital advertising experience is strongly preferred.
Familiarity with the GDPR/UK GDPR, international data transfers, cross-border data sharing, and related contractual mechanisms.
Familiarity with consent and preference management, IAB frameworks such as the Global Privacy Platform or Transparency and Consent Framework, privacy management tools, data mapping, and records of processing activities.
Additional privacy certification, such as CIPM, CIPT, or an equivalent credential, is a plus.

Enabling your best to power a better media future.

Nielsen makes hiring decisions without regard to disability status, protected veteran status, or membership in any other protected class.

Originally posted on Himalayas

Job Description

Advise on privacy compliance, data governance, and risk mitigation for business operations, products, data partnerships, and commercial transactions.
Apply expanded knowledge and experience in privacy and data protection law while continuing to develop higher-level expertise.
Solve a range of privacy and commercial legal problems using sound judgment, established frameworks, and practical business analysis.
Draft, review and negotiate complex data protection exhibits on both the buy-side and sell-side.
Receive moderate guidance and direction while taking ownership of assigned matters and workstreams.

Responsibilities

Provide day-to-day legal guidance on U.S. federal and state privacy laws, including the CCPA/CPRA and the evolving patchwork of comprehensive state privacy statutes, as well as applicable sectoral, consumer protection, marketing, and data security requirements.
Maintain an in-depth working knowledge of U.S. state privacy regulations and translate legal developments into clear, actionable guidance, contract language, policies, notices, processes, and implementation requirements.
Draft, review, and negotiate data processing agreements (DPAs), data protection and security terms, data use and sharing agreements, and related privacy provisions in commercial contracts, representing Nielsen both as a data buyer/customer and as a data seller, provider, or service provider.
Conduct and support privacy impact assessments (PIAs/DPIAs) for products, features, data uses, partnerships, and other initiatives; identify risks, recommend mitigations, and help embed privacy by design and by default.
Conduct privacy due diligence on third parties, vendors, customers, and strategic partners, including reviewing questionnaires and security materials, assessing processing activities and data flows, identifying gaps, negotiating remediation, and supporting ongoing oversight.
Advise on advertising technology, audience measurement, analytics, identity, cookies, pixels, SDKs, targeted advertising, consent and preference management, data monetization, and related media and marketing data practices. Experience in adtech is strongly preferred.
Partner with Product, Engineering, Data Science, Information Security, Procurement, Sales, Marketing, and other stakeholders to assess proposed data collection, use, disclosure, retention, and deletion activities and to support compliant launches and operational changes.
Support privacy incident and data breach response, consumer and data subject rights escalations, regulatory inquiries, audits, and other privacy compliance matters in coordination with relevant internal teams and outside counsel.
Contribute to privacy program materials, including policies, procedures, playbooks, templates, training, records of processing, data inventories, and compliance reporting.
Monitor changes in privacy and data protection laws and enforcement trends, assess their impact on Nielsen’s business, and communicate concise recommendations to stakeholders.
Manage multiple priorities in a fast-paced, global environment and provide clear, timely, and pragmatic advice to both legal and non-legal audiences.

Role-Level Expectations

Understands key business drivers and uses this understanding to accomplish assigned work.
Solves standard and moderately complex problems by analyzing possible solutions using experience, judgment, and precedent.
Has no supervisory responsibilities but may provide guidance to new associates or colleagues.
Explains privacy and legal information to others in straightforward and actionable terms.
Requires expanded conceptual knowledge in privacy and data protection while developing additional skill sets.
Impacts the quality of own work and the work of the team while operating within applicable guidelines and policies.

2 - 5 years of experience practicing privacy, data protection, technology, commercial, or related legal work, preferably in-house or in a law firm advising technology, media, advertising, data, or analytics businesses.
J.D. or equivalent legal qualification and admission to at least one U.S. state bar, consistent with the requirements for the role.
At least 2 years of experience with U.S. state privacy regulations, including the CCPA/CPRA and other comprehensive state privacy laws, with the ability to interpret requirements and operationalize them across products, contracts, and business processes.
At least 2 years of experience with demonstrated experience conducting or supporting DPIAs/PIAs and privacy risk assessments, including documenting risks and tracking mitigation measures.
Demonstrated experience drafting, reviewing, and negotiating DPAs and other privacy-related contract terms, including experience advising both buyers/customers and sellers/providers of data or services.
Strong legal research, writing, negotiation, analytical, and issue-spotting skills, with the ability to explain complex privacy requirements in clear business terms.
Ability to work collaboratively with cross-functional and international teams, exercise sound judgment, manage competing priorities, and operate effectively with moderate supervision.

Preferred Qualifications

Knowledge of APAC privacy and data protection regulations -particularly India’s Digital Personal Data Protection framework, Australia’s Privacy Act and Australian Privacy Principles, or South Korea’s Personal Information Protection Act - greatly preferred, but it is not a hard requirement.
CIPP/US certification is a significant advantage.
Adtech, Martech, media measurement, audience analytics, data licensing, or digital advertising experience is strongly preferred.
Familiarity with the GDPR/UK GDPR, international data transfers, cross-border data sharing, and related contractual mechanisms.
Familiarity with consent and preference management, IAB frameworks such as the Global Privacy Platform or Transparency and Consent Framework, privacy management tools, data mapping, and records of processing activities.
Additional privacy certification, such as CIPM, CIPT, or an equivalent credential, is a plus.

Enabling your best to power a better media future.

Nielsen makes hiring decisions without regard to disability status, protected veteran status, or membership in any other protected class.

Originally posted on Himalayas