Senior Counsel - Data Governance, Privacy and Cybersecurity

Our team members are at the heart of everything we do. At Cencora, we are united in our responsibility to create healthier futures, and every person here is essential to us being able to deliver on that purpose. If you want to make a difference at the center of health, come join our innovative company and help us improve the lives of people and animals everywhere. Apply today!

Job Details

Cencora is seeking a Corporate Counsel II (Senior Counsel) with experience advising and providing strategic leadership in data governance, privacy, cybersecurity, and AI as they apply to our Managed Services Organization (“MSO”), which serves clinical practice groups in the retinal space across the United States.

This role reports to the Assistant General Counsel, Privacy, Responsible Data, & Technology within Cencora’s legal team and serves as a key legal resource to MSO legal and business teams on the design, launch, and operation of MSO technology-based services, including the collection, use, sharing, and protection of sensitive health information and other regulated data.

This role requires an energetic, agile legal expert who will collaborate closely with our MSO medical professional teams, clinical operations, product/technology experts, information security, compliance, and commercial teams to enable MSO offerings while managing risk in a highly regulated healthcare environment.

The successful candidate will deliver business-oriented legal services and project management across MSO initiatives, including conducting privacy-by-design and security-by-design reviews; analyze prospective and retrospective research protocols from privacy and technology law angles; review and enable prioritized data sharing and interoperability arrangements; evaluate and drive AI projects and governance; and ensure incident response readiness and swift mitigation response for MSO platforms and associated vendor ecosystems.

Primary Duties and Responsibilities:

• •Serve as a key counsel for MSO data governance, privacy, AI, and cybersecurity matters, including advising on MSO data flows and operating models; the use and protection of PHI and other sensitive data; and compliance with applicable U.S. federal and state privacy and security requirements (e.g., HIPAA/HITECH and state consumer health privacy laws, as applicable).
• •Counsel MSO business owners on privacy, security, and AI requirements for new and existing MSO offerings, including product counseling for MSO platforms, analytics, care/therapy services support, population health insights, and other data-enabled services.
• •Draft, review, and negotiate MSO-facing privacy and security contractual terms, including BAAs, DPAs, data sharing agreements, service agreements, and vendor/partner security addenda; advise on third-party risk management, subcontractor flow-downs, and MSO client requirements.
• •Partner with MSO information security and technology teams to support MSO security program needs (e.g., NIST-aligned controls, HITRUST/ISO considerations where required).
• •Assist in MSO incident response preparedness and legal support; advise on breach assessment and notification obligations; and coordinate with privacy, security, compliance, communications professionals, and client teams on incident-related MSO client, patient, and/or regulatory communications.
• •Support MSO governance and reporting, and assist in responses to MSO client audits, questionnaires, and regulatory inquiries relating to privacy and cybersecurity representations.
• •Establish and maintain strong relationships and clear escalation paths with MSO stakeholders (clinical/medical, operations, product/engineering, security, compliance, commercial, and other legal and compliance colleagues) to drive consistent, scalable MSO approaches to data governance, privacy, and security risk management and to enable MSO data innovation goals.

EXPERIENCE AND EDUCATIONAL REQUIREMENTS:

The lawyer in this role is expected to have a minimum of 4–8 years of experience as a lawyer, combined with expertise in privacy, cybersecurity, and/or data governance. The attorney must have a law degree—i.e., be a graduate of an accredited law school—and be admitted to a U.S. state bar.

The lawyer in this role is comparable to a senior associate or expert counsel in health data law at a law firm. This professional can navigate novel legal arenas, complete sophisticated and nuanced legal analysis, and deliver clear implementation guidance with minimal supervision in a fast-paced, risk-prioritized manner. The lawyer in this role should also be able to work collaboratively in cross-functional settings to advance shared business and risk-management goals.

Minimum Skills, Knowledge and Ability Requirements:

The lawyer in this role should demonstrate the following skills, background, and/or experience:

Working familiarity with a variety of cybersecurity and privacy regulations and frameworks relevant to MSO operations, including HIPAA/HITECH, state privacy laws (including consumer health privacy laws, as applicable), SEC cybersecurity disclosure rules (as applicable), AI regulatory frameworks, and commonly used security standards (e.g., NIST CSF/800-53), as needed to counsel clients and business partners.

• •Knowledgeable in healthcare business and industry models, typical practices and trends, and capable of quickly learning the competitive landscape.
• •Strong decision-making capability and proficiency in communicating business-oriented yet legally compliant recommendations to business partners.

• •Ability to solve both straightforward and complex problems and to take a new perspective on existing, but potentially inefficient, solutions.
• •Experience in juggling multiple matters and effectively multi-tasking and prioritizing deliverables to ensure that work is completed in a timely and efficient manner.
• •Willingness to embrace change and to shift priorities and focus, often with minimal advance warning/direction.

• •Ability to communicate effectively, both orally and in writing.
• •Robust collaboration skills and the ability to work smoothly with all levels of business and professional colleagues.
• •Effective interpersonal, negotiation, presentation, and communication skills, as well as organizational savvy, creativity, and legal trend-spotting skills.
• •Demonstrated attention to detail and ability to learn nuances of new technologies or approach that impact the MSO and associated clinical space, particularly in the data insights arena.
• •Proficiency in Microsoft Word, Excel, PowerPoint, Teams, Sharepoint and the AI capabilities associated with this suite of tools.

What Cencora offers

We provide compensation, benefits, and resources that enable a highly inclusive culture and support our team members’ ability to live with purpose every day. In addition to traditional offerings like medical, dental, and vision care, we also provide a comprehensive suite of benefits that focus on the physical, emotional, financial, and social aspects of wellness. This encompasses support for working families, which may include backup dependent care, adoption assistance, infertility coverage, family building support, behavioral health solutions, paid parental leave, and paid caregiver leave. To encourage your personal growth, we also offer a variety of training programs, professional development resources, and opportunities to participate in mentorship programs, employee resource groups, volunteer activities, and much more. For details, visit https://www.virtualfairhub.com/cencora

Full time

Salary Range*

$119,100 - 186,560

*This Salary Range reflects a National Average for this job. The actual range may vary based on your locale. Ranges in Colorado/California/Washington/New York/Hawaii/Vermont/Minnesota/Massachusetts/Illinois State-specific locations may be up to 10% lower than the minimum salary range, and 12% higher than the maximum salary range.

Equal Employment Opportunity

Cencora is commit