Outbreach is seeking a Director of Legal and Breach Counsel to lead a new function delivering breach counsel to clients and owning our contract estate.
Outbreach is looking for a Director of Legal and Breach Counsel to lead a new function that does two distinct jobs. The first is client facing: breach counsel delivered as a service, advising organisations on the legal consequences of an incident while it is still live. The second is internal: owning the contracts, terms and privilege positions that a fast growing incident response business runs on. We work alongside instructing solicitors and insurers rather than in competition with them, and our reports are written to be usable in proceedings. You would build the function from a standing start, with two Legal Associate seats to recruit and an external counsel panel to appoint.
- Breach Counsel: Lead breach counsel as a client facing service line, covering notification strategy, regulatory exposure and the decisions clients must make in the first seventy two hours.
- Privilege: Own the privilege position on engagements, including the Legal Professional Privilege assertions carried in litigation grade reports.
- Regulatory Advice: Advise on notification obligations across UK GDPR, EU GDPR and the international regimes our clients are exposed to, including sector regulators.
- Litigation Support: Support litigation and disclosure alongside instructing solicitors, and appoint external counsel where court representation is needed.
- Contract Estate: Own our master services agreements, data processing agreements, subcontractor terms and back to back liability positions.
- Risk Positions: Own the liability, indemnity and insurance positions we take in negotiation, and know when to hold and when to trade.
- Insurance Proposition: Advise on the legal framework for our insurance backed cover proposition as it develops.
- Team Building: Recruit and lead the Legal Associate seats and manage the external counsel panel.
- Bid Support: Provide legal input to public sector tenders and framework compliance.
Skills and Experience:
- Qualification: Qualified lawyer, England and Wales or a comparable jurisdiction, with substantial post qualification experience.
- Subject Depth: Genuine data protection and cyber incident depth. This is not a general commercial role with a privacy interest.
- Live Incident Experience: Experience advising during live incidents, ideally from a law firm cyber practice, an insurer, a breach response panel or an in house role that handled real breaches.
- Commercial Contracting: MSAs, DPAs, liability caps, supplier and subcontractor terms.
- Privilege Structuring: Clear on privilege in an investigatory context, and able to structure engagements to protect it.
- Pace: Able to give a client a straight answer quickly, with the caveats that matter and none of the ones that do not.
- Autonomy: Comfortable being the only lawyer in the room, and in the business.
Highly Desirable (But Not Essential):
- Experience on an insurer breach response panel.
- Regulatory engagement experience with the ICO or an equivalent authority.
- Familiarity with UAE data protection law and the DIFC and ADGM regimes.
- Insurance or reinsurance experience, particularly cyber wordings.
- CIPP, CIPT or a similar certification.
Incidents happen at inconvenient times and the legal calls are often the urgent ones, so there is an on call element to this role. What you get in exchange is an unusual amount of autonomy, because the function does not exist yet and its shape is yours to set.
#J-18808-Ljbffr
