SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Imprint is a fintech company that modernizes co-branded credit card programs for major brands like Crate & Barrel, Rakuten, Booking.com, H-E-B, Fetch, and Shell. The company combines payments infrastructure, intelligent underwriting, and customer data to create personalized financial experiences without requiring partners to become banks. Backed by top-tier VCs including Kleiner Perkins, Thrive Capital, Ribbit, and Khosla Ventures, Imprint is redefining how people pay and how brands build customer loyalty.
You will join the legal team as the first-line owner of data, privacy, and information-security legal work. This is a high-ownership individual contributor role where you'll serve as the primary legal resource for data-sharing and privacy questions across ongoing and launching programs. You'll have direct access to senior leadership and real influence on how customer data powers Imprint's products.
Key responsibilities include: advising on partner data-sharing arrangements and documenting legal bases for data flows; managing privacy opt-outs and suppression obligations across datasets and third parties; providing practical FCRA guidance on permissible purposes and credit-report use; advising on GLBA/Regulation P compliance and drafting privacy notices; interpreting state privacy laws (CCPA/CPRA and emerging regimes) and AI/automated-decision-making requirements; owning data retention and deletion policies; partnering with Security and GRC on vendor risk assessments and incident response; providing product counseling on features affecting data sharing or privacy; coordinating with Compliance on regulatory matters; and translating complex requirements into actionable guidance for cross-functional teams.
In your first 90 days, you'll build relationships with Data, Engineering, Security, and Compliance teams; take ownership of day-to-day data-sharing and privacy reviews; provide FCRA and GLBA/Reg P guidance on live matters; advise on data retention and at least one information-security matter; and track legal requests with clear timelines.
You'll report to the Associate General Counsel and work alongside a small, experienced legal team. This role is ideal for a self-driven attorney who thrives in fast-moving environments, builds strong cross-functional relationships, and takes pride in owning work end-to-end.
REQUIREMENTS:
- J.D. from an accredited law school and active membership in good standing with at least one U.S. state bar
- 4 to 8 years in data privacy law with demonstrated expertise in GLBA/Regulation P, FCRA, and state privacy laws including CCPA
- Experience in financial services, fintech, or high-growth startup environments
- Working knowledge of FCRA and GLBA/Regulation P; familiarity with state privacy laws (CCPA/CPRA and newer regimes) and their practical application to data sharing and product
- Experience advising on data-sharing arrangements, privacy notices and opt-outs, and data retention
- Strong contract review skills, including data-sharing agreements, DPAs, and regulatory-facing documentation
- Comfort partnering with security and information-security teams on vendor risk assessments, data protection, and incident response
- Demonstrated ability to work autonomously, own work end-to-end, manage competing priorities, and deliver clear legal guidance under tight timelines
- Strong communicator who proactively updates stakeholders and builds relationships across teams; able to explain legal risk to engineers, data questions to analysts, and regulatory nuances to business leaders
- Willingness to research independently and verify findings with senior team members
NICE TO HAVE:
- Privacy certification (e.g., CIPP/US)
- Experience with FCRA in lending or credit context, ECOA/Reg B adverse action, and automated decision-making/AI governance
- Familiarity with data-security frameworks (PCI DSS, SOC 2, NIST) and breach/incident-response processes
- Familiarity with additional consumer finance regulations (TILA/Reg Z, EFTA/Reg E, UDAAP, CAN-SPAM, TCPA)
- Experience in sponsor bank, banking-as-a-service, or fintech partnership environments
- Experience with GDPR applicability and ROPA obligations
- Experience with ticketing or project management systems (Linear, Jira, Asana)
- Comfort with legal technology, AI-assisted workflows, and process automation
- Experience with consumer credit products (credit cards, buy-now-pay-later)
- Experience building or standardizing privacy frameworks across multiple product lines or partner programs
