About the role
Hilbert is a scalable, data science-first growth engine that gives B2C teams predictive clarity into user behavior, revenue drivers, and the actions that drive sustainable growth. Fully agentic by design, Hilbert shrinks months-long decision cycles to minutes. From Fortune 10 enterprises to beloved brands like FreshDirect, Blank Street, and Levain Bakery, operators run their growth on Hilbert. We're also co-building alongside leading AI companies. We're looking for a Privacy & Product Counsel who can build Hilbert's privacy program from the inside of the product - not bolt one on after the fact - who is fluent across US, UK, and European privacy law, and who can move at the speed our engineering and GTM teams already move at, with the ownership and urgency of a startup culture. You'll be the first dedicated privacy hire, embedded with product and engineering as we design agentic systems that touch consumer data across dozens of enterprise environments and the person our biggest customers' legal and security teams call when they want to understand how our AI actually handles their data - wherever they're based. You'll also be the generalist backstop for whatever legal question lands on the desk that week.
THE ROLE You'll work directly with the founding team and across product, engineering, and GTM to build and run Hilbert's privacy program end-to-end - while also owning the product and commercial legal work that comes with selling an agentic AI platform into enterprise accounts. The environment is high-autonomy and high-ambiguity - new data types, new customer environments, and new AI capabilities show up faster than settled law does.
What you'll do: Privacy Program Design, build, and run Hilbert's privacy program - policies, data mapping, retention, and vendor/subprocessor management - from the ground up, covering both US and UK/EU entities and data flows Advise product and engineering on privacy-by-design for agentic workflows: what data an agent can access, retain, infer, or act on, and how that's documented and defensible under whichever regime applies Own compliance posture across CCPA/CPRA and the US state privacy patchwork, UK GDPR/DPA 2018, and EU GDPR, and track how state, federal, UK, and EU AI-specific rules are developing Build and maintain data processing agreements, international data transfer mechanisms (SCCs, UK IDTA/Addendum), and subprocessor frameworks that scale across enterprise customers without a bespoke redline every time Product & Commercial Counsel Review and negotiate enterprise customer contracts, DPAs, and security addenda across US and UK/EU counterparties, working closely with sales to keep deals moving without compromising the company's data commitments Advise product on how new agentic features get built, marketed, and disclosed — including where an AI decision needs a human-in-the-loop checkpoint for legal or trust reasons Partner with security on incident response, breach notification obligations, and customer-facing security representations across jurisdictions Be the primary point of contact for enterprise customers' legal, security, and procurement teams when they ask how Hilbert's AI handles their data WHO THRIVES IN THIS ROLE The right person in this role is quick to turn regulatory nuance into a product decision and show up with both engineers and enterprise counterparts. The profile: You have 6–7 years of PQE in privacy and product/commercial counsel , ideally split between in-house work at a data-intensive or AI company and enterprise contract negotiation. You're genuinely fluent across US, UK, and EU privacy law — CCPA/CPRA and the state patchwork, UK GDPR/DPA 2018, and EU GDPR. You think like a product person, not just a lawyer. You'd rather sit in a design review and shape a data flow before it's built than redline it after. You've negotiated enterprise DPAs, security addenda, and cross-border transfer mechanisms directly . You're a genuine generalist, not just a specialist who's willing to help out. You communicate with clarity and conviction. You can explain a data-retention tradeoff to a founder, hold your ground with an enterprise customer's outside counsel, and walk an engineer through why a feature needs a consent gate — all in the same day. You take ownership. There's no one to hand this to. If the privacy program has a gap, you close it. If a deal is stuck on a legal term, you find the path through. You move at startup speed. Deals close fast, product ships fast, and you're available and responsive without needing a legal-ops process to get there. Location San Francisco or London, hybrid, with occasional travel for customer engagements and to work with the other office.