Job description

At Bath & Body Works, we believe everybody deserves to feel good. When you join us, you're part of more than an iconic fragrance and personal care brand — you become part of Gingham Nation, where people are at the center of everything we do. We believe great associate experiences create great consumer experiences. When our associates feel supported, inspired and empowered, consumers feel it. Whether you're starting your career or building your next chapter, we invest in your growth so you can learn, lead and help create feel good moments every day. The Associate Vice President, Legal – Privacy, Cybersecurity & AI Governance leads the company’s domestic and international privacy, data governance, cybersecurity legal, and artificial intelligence governance programs. This role provides practical legal counsel, strengthens enterprise risk management, and partners across the business to enable responsible data use, automation, and innovation. Responsibilities · Privacy and AI Governance: Lead and continuously improve privacy, data, and AI governance programs in alignment with business priorities, legal requirements, and recognized frameworks, including NIST. · Legal Counsel and Risk Management: Advise leaders on privacy, cybersecurity, AI, data use, automation, and emerging legal risks. Translate complex requirements into practical, business-oriented solutions. · Policies and Assessments: Develop and maintain policies, standards, procedures, and privacy and AI risk-assessment processes that identify, prioritize, and mitigate risk. · Third-Party and Contract Risk: Oversee privacy, cybersecurity, data protection, and AI reviews for vendors and commercial agreements. Maintain relevant contract terms and templates. · Incident Response: Direct legal support for data and cybersecurity incidents, including preparedness exercises, investigations, escalation, notification, reporting, and remediation. · Data Subject Rights: Oversee compliant and efficient data-subject-rights processes and supporting automation. · Training and Awareness: Deliver enterprise and role-based education that strengthens privacy, cybersecurity, and AI accountability. · Litigation and Regulatory Support: Provide subject-matter expertise for privacy-related disputes, investigations, litigation, and regulatory matters in partnership with internal and external counsel. · Cross-Functional Partnership: Partner with IT, Cybersecurity, Digital, Marketing, HR, and other functions to embed privacy and responsible AI into business processes and technology initiatives. · Leadership Communication: Present clear assessments, recommendations, and program updates to executive leaders and, as appropriate, the Board of Directors. · Team and Resource Leadership: Lead, develop, and retain a high-performing legal team while managing priorities, external counsel, and budget responsibly. Qualifications · 12+ years of progressive legal experience, including leadership responsibility in a global environment; public company experience preferred. · Deep expertise in privacy law, with strong working knowledge of cybersecurity, data governance, and artificial intelligence law and regulation. · Demonstrated experience building and operationalizing governance programs, policies, risk assessments, and incident-response processes. · Ability to learn and apply emerging bodies of law to evolving business models, technologies, and markets. · Strong executive communication, judgment, change leadership, collaboration, and decision-making skills. · High integrity and discretion in handling sensitive and confidential information. Education · Juris Doctor degree from an accredited law school and active license in good standing in at least one U.S. jurisdiction. · Bachelor’s degree. Core Competencies • Drives Results • Action Oriented • Collaborates • Decision Making • Nimble Learning Benefits Feeling good starts with you. We invest in benefits that support your well-being, growth and future, helping you thrive as a creator of feel good — every day. Benefits for eligible associates include: • Robust medical, dental, vision and pharmacy coverage. Plus, access to our onsite wellness center and pharmacy located at the Columbus, OH home office. • No-cost mental health and well-being support through our Employee Assistance Program (EAP). • 401(k) with company match and Associate Stock Purchase Program with discount. • Opportunity for paid time off, paid parental leave and access to family building benefits. • Home, auto and pet insurance and a company-provided Care.com subscription. • Tuition reimbursement and scholarship opportunities for post-secondary education. • Enjoy complimentary products and a 40% merchandise discount so you can experience and share the brand you love. • Visit bbwbenefits.com for more details. The above statements are intended to describe the general nature and level of work being performed by people assigned to this job. They are not intended to be an exhaustive list of all responsibilities, duties and skills required. We will consider for employment all qualified applicants, including those with arrest records, conviction records, or other criminal histories, in a manner consistent with the requirements of any applicable state and local laws. Please see links: Los Angeles Fair Chance In Hiring Ordinance , Philadelphia Fair Chance Law , San Francisco Fair Chance Ordinance , Washington Fair Chance Act Guide We are an equal opportunity employer. We do not make employment decisions based on an individual’s race, color, religion, gender, gender identity, national origin, citizenship, age, disability, sexual orientation, marital status, pregnancy, genetic information, protected veteran status or any other legally protected status, and we comply with all laws concerning nondiscriminatory employment practices. We are committed to providing reasonable accommodations for associates and job applicants with disabilities. Our management team is dedicated to ensuring fulfillment of this policy with respect to recruitment, hiring, placement, promotion, transfer, training, compensation, benefits, associate activities and general treatment during employment. We only hire individuals authorized for employment in the United States. Application window will close when all vacancy/vacancies are filled.

Requirements

Must-haves

Privacy and AI Governance: Lead and continuously improve privacy, data, and AI governance programs in alignment with business priorities, legal requirements, and recognized frameworks, including NIST.
Legal Counsel and Risk Management: Advise leaders on privacy, cybersecurity, AI, data use, automation, and emerging legal risks. Translate complex requirements into practical, business-oriented solutions.
Policies and Assessments: Develop and maintain policies, standards, procedures, and privacy and AI risk-assessment processes that identify, prioritize, and mitigate risk.
Third-Party and Contract Risk: Oversee privacy, cybersecurity, data protection, and AI reviews for vendors and commercial agreements. Maintain relevant contract terms and templates.
Incident Response: Direct legal support for data and cybersecurity incidents, including preparedness exercises, investigations, escalation, notification, reporting, and remediation.
Data Subject Rights: Oversee compliant and efficient data-subject-rights processes and supporting automation.
Training and Awareness: Deliver enterprise and role-based education that strengthens privacy, cybersecurity, and AI accountability.
Litigation and Regulatory Support: Provide subject-matter expertise for privacy-related disputes, investigations, litigation, and regulatory matters in partnership with internal and external counsel.
Cross-Functional Partnership: Partner with IT, Cybersecurity, Digital, Marketing, HR, and other functions to embed privacy and responsible AI into business processes and technology initiatives.
Leadership Communication: Present clear assessments, recommendations, and program updates to executive leaders and, as appropriate, the Board of Directors.
Team and Resource Leadership: Lead, develop, and retain a high-performing legal team while managing priorities, external counsel, and budget responsibly.
Deep expertise in privacy law, with strong working knowledge of cybersecurity, data governance, and artificial intelligence law and regulation.
Demonstrated experience building and operationalizing governance programs, policies, risk assessments, and incident-response processes.
Ability to learn and apply emerging bodies of law to evolving business models, technologies, and markets.
Strong executive communication, judgment, change leadership, collaboration, and decision-making skills.
High integrity and discretion in handling sensitive and confidential information.
Juris Doctor degree from an accredited law school and active license in good standing in at least one U.S. jurisdiction.
Bachelor’s degree.
Core Competencies
Drives Results
Action Oriented
Collaborates
Decision Making

Nice-to-haves

12+ years of progressive legal experience, including leadership responsibility in a global environment; public company experience preferred.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

Platform: paradox
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Paid Time Off

Parental Leave

Wellness