Legal Counsel — Cyber Security, Technology Safety & Physical Security

About Nebius

Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.

Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.

Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.

The role

The Legal Counsel provides senior, practical, risk-based legal counsel at the intersection of cybersecurity, Artificial Intelligence, cloud compute and services, physical security, supply chain and technology oriented regulatory compliance. The counsel will work closely with Security teams to support their efforts to address the needs of the company’s various business units, and enable the attainment of the company’s business and product objectives while protecting the company from obligations that are unclear, disproportionate, operationally unachievable, or inconsistent with the company’s security posture. The role is expected to lead cross-functional initiatives, not only respond to individual legal requests.

Security terms in customer contracts

• Review, draft, and negotiate cybersecurity, physical security compliance, , supply chain and resilience provisions in customer documents, including MSAs, DPAs, security addenda, order forms, and related schedules.

• Advise on security-control commitments, audit and assessment rights, incident-notification obligations.penetration testing, business continuity, data retention and deletion, subcontractors, cloud services, and allocation of liability.

• Translate technical controls and architecture into clear, supportable contractual language without overstating capabilities or creating unbounded obligations.

• Advise Product and Engineering on customer-driven requirements and translate recurring negotiations into scalable product, policy, and commercial positions.

• Support Sales and Customer Success with timely, commercially pragmatic guidance during strategic and high-value transactions.

Certifications, audits, and external assurance

• Provide legal support for security certifications, attestations, and assurance programs, such as ISO 27001, SOC 2, PCI DSS, or other frameworks relevant to the company.

• Review certification scope, statements, evidence-sharing terms, management representations, auditor engagement terms, confidentiality obligations, and external communications.

• Help ensure that customer-facing descriptions of certifications and controls are accurate, current, and do not imply broader coverage than the underlying assessment supports.

• Partner with Security and Compliance on remediation plans, audit findings, regulator or customer inquiries, and the controlled disclosure of reports and evidence.

Security governance, regulatory advice, and risk

• Managing DORA, NIS2, CRA frameworks, serving as principal point of contact with authorities in this respect.

• Monitor and interpret cybersecurity, operational resilience digital-services, and technology requirements applicable to the company’s products, services, customers, and geographic footprint.

• Assist in supporting physical security units

• Assist the company GRC to advise on security policies, standards, risk acceptance, third-party risk, cloud governance, secure development practices, vulnerability disclosure, and responsible use of emerging technologies, including AI where applicable.

• Participate in security and product governance forums and provide legal input to material risk decisions, secure development practices, control exceptions, product launches, vendor onboarding, and significant architecture or service changes.

Incident readiness and response

• Support preparation and maintenance of cyber-incident response plans, notification matrices, decision logs, tabletop exercises, and external communication protocols.

Operations and enablement

• Assessment and adoption of reference to specific legislation and regimes.

• Develop playbooks, clause libraries, decision trees, intake forms, templates, and training that enable consistent handling of security-related legal work.

• Define service levels and prioritization rules with Legal and Security; track volume, cycle time, recurring negotiation themes, exceptions, and material commitments.

• Deliver practical training to Security, Sales, Product, Engineering, Procurement, and Customer Success teams.

• Recommend process and tooling improvements that reduce manual work while maintaining appropriate legal and security review.

We expect you to have

• Law degree and admission to practice, or equivalent professional legal qualification in a relevant jurisdiction.
• 5+ years of relevant legal experience, including significant in-house responsibility for technology, cybersecurity, cloud services, product counseling, commercial contracts, or regulated products.
• Demonstrated progression into a senior counsel, legal director, or comparable leadership role with ownership of complex, business-critical matters.
• Demonstrated experience negotiating customer security and data-protection terms and advising Security, Product, Engineering, and executive stakeholders.
• Working knowledge of common security and assurance frameworks and the ability to understand technical concepts sufficiently to assess legal and contractual implications.
• Strong judgment, concise drafting, executive communication, strategic project management, and the ability to prioritize multiple time-sensitive matters in a commercial environment.
• High integrity and discretion when handling privileged, confidential, security-sensitive, or incident-related information.

It will be an added bonus if you have

• Senior in-house experience with a SaaS, cloud, cybersecurity, enterprise technology, or other business-to-business technology company.
• Experience supporting security certifications, external audits, trust centers, public-sector customers, or highly regulated customers.
• Experience with global cybersecurity and resilience regimes and with coordinating advice across multiple jurisdictions.
• Experience building scalable legal intake, contract playbooks, knowledge bases, workflow automation, or legal-operations programs.
• Prior work involving cyber affairs, government, defense, international or regional legal matters, or other high-stakes regulated environments.
• An advanced degree or formal specialization in international law, technology law, cybersecurity, privacy, or a related discipline.

Benefits & Perks

• Competitive compensation
• Career growth and learning opportunities
• Flexibility and ownership
• Collaborative and innovative culture
• Opportunity to work on impactful AI projects
• International environment and talented teams

What’s it like to work at Nebius

Fast moving – Bold thinking – Constant growth – Meaningful impact – Trust and real ownership – Opportunity to shape the future of AI

Equal Opportunity Statement

Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law.

Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire.

If you need accommodations during the application process, please let us know.