Cybersecurity Law & Strategy®

September 2019

The State of the U.S. Privacy Job Market, 2019: Part Two

A Reflection on the Year Behind, the Years Ahead, and Why Privacy Means So Much to Us Part Two of a Two-Part Article

art One of The State of the security, risk advisory, and e-discov- Consulting, , U.S. Privacy Job Market, ery consulting — sometimes from , , BRG, Ankura, and P2019 exposed the current outside/inside counsel — and now many more. The maturity model of state of the market, highlighting the have dozens if not hundreds of dis- each varies drasti- expansive mid-market job growth parately skilled privacy cally from brand to brand, which and extensive use of contract talent ranking from entry level to sea- has created opportunities for strong resources, then drilled down into soned partner. The war for privacy players at established practices to the nuances of staffing habits within talent among these firms has begun bring their expertise and clientele U.S. corporations and major law and will continue in perpetuity. to midsized logos looking to invest firms. Part two of The State of the Consulting firms generally want to in talent to grow faster. This has U.S. Privacy Job Market, 2019 will hire consultants from other consult- also allowed larger companies to outline what is happening within ing firms; that is traditionally first begin investing in less experienced service providers, consultancies, preference. There are opportunities talent, grooming from within, and and vendors will touch briefly on for in-house corporate-tracked pri- create newer, less expensive con- government agencies and will pre- vacy professionals to transition into sultants to deploy to clients who dict the near-future state of the U.S. a major label in the global consult- are also in a heightened state of privacy job market. ing firm ecosystem, but those with- privacy maturity and now need What Is Happening In Vendors/ out existing relationships and lower rates for maintenance/impact Consulting Firms possible streams of revenue (and assessment consulting work. The largest consulting firms in the especially those without the desire The cost and utilization necessary world have been building privacy- or aptitude to eventually drive rev- for more maintenance-oriented pri- focused consulting practices for enue) will struggle to transition at vacy consulting engagements over half a decade. These practices their desired compensation. become a key consideration for are often hatched from leaders in The market for privacy consulting consulting firms’ business models is incredibly polarized. There are moving beyond GDPR day. What generally large consulting firms may have felt like corporate panic Jared Coseglia is the founder and CEO of TRU Staffing Partners, an Inc 5000 Fastest that do this work, from quasi-legal between mid-2017 to late 2018 Growing American Company 2016 & 2017 advisement to fully operationaliz- appears to have ushered in a corpo- and National Law Journal’s #1 Legal ing and running privacy by design rate acknowledgment and aware- Staffing Agency. A member of our Board programs, and there are also a lot ness of privacy as a necessary of Editors, he has over 15 years of experi- of boutiques. The large players in function and brand consideration, ence representing thousands of profes- sionals in e-discovery and cybersecurity the space are certainly the “Big both operationally and strategically. throughout the world. Contact him at Four” but also all of their competi- Some corporations hire consultants [email protected]. tors such as BDO Global, FTI from their consulting firms, bringing LJN’s Cybersecurity Law & Strategy September 2019 the functions in house; this is an alphabet agencies. The privacy team corporations and vice versa, regard- age-old practice. Others simply is usually led by a tenured leader at less of industry vertical. diminish the billable hours needed the boutique firm, and the rest of Future State from their trusted consulting firm the talent is often contractors. Win- partners. ning federal bids usually means Several possible events can — or The nature of the work needed is contracts have finite timelines, will — have a dramatic effect on the also changing and often no longer tough and potentially lengthy ones privacy job market in the next few requires the most senior of partners (one to three years). Offering a years. to be available to maintain the day- long-term contract is a comfortable The most important variable in to-day privacy needs of the client. modality for privacy pros accus- predicting the outlook of the U.S. This is where contractors are play- tomed to federal employment and, privacy job market is the rapidly ing a key role. Managing directors perhaps surprisingly, is something evolving state-by-state legislation are bringing in temporary, often most actively job-seeking privacy sprouting across the country, stand- part-time resources to handle main- professionals subscribe to comfort- ing in stark contrast to the lack of tenance while they shift efforts to ably. “Years” is a long time to some- clearly impending federal regula- driving more revenue and person- one who has chosen the contract tion that can serve as one law to ally billable consulting hours. The lifestyle, and the privacy vertical is rule them all. Keeping up with all high-performing privacy contractor full of professionals who crave that fifty individual state laws, plus that can get patched into a consult- lifestyle and occasionally, the stabil- international regulations can be ing firm with multiple part-time ity of something as long-term as taxing on companies, particularly accounts can quickly find more “years.” smaller ones. (The International than enough hours to compensate Mid-level privacy professionals Association of Privacy Professionals for the concern of an inconsistent coming out of boutique consulting [IAPP] has a great resource avail- and unpredictable amount of bill- firms have tremendous opportunity able to keep everyone updated on able hours. to make a career move into a much state legislation status.) Most pri- Many established privacy pros, a larger consulting firm after getting vacy leaders want to see a federal vast majority of whom are lawyers even just a little experience. Life- U.S. privacy law for this very rea- or former CPOs/GCs at corpora- style and job demand expectations son, but also because the disparity tions, have decided to “hang out can differ dramatically from small of state-mandated regulations con- their shingle” and try their luck at to giant employers, and privacy tradicts one of the cornerstones of building startup privacy practices pros are well-advised to consider many Fortune 1000 privacy policy all over the world. Many are sole culture as much as cash when con- stances, which is: “Keep privacy owner/practitioners, some have sidering a next step. Privacy consul- simple.” For better or worse, this grown to double-digit headcount, tants coming from well-known disparity is creating jobs, namely but almost all in this category are logos are well-positioned to move for the contract augmentation pri- exploring the use of contract pri- in-house to corporations. The cul- vacy lawyers within law firms and vacy augmentation for two reasons: ture change between consulting corporate legal departments (see One, they themselves become the firm and corporate client can also Part One). With a presidential elec- contractor and lend their talents to be notably jarring. The assumption tion looming and uncertainty a larger consulting firm, corpora- that quality of life improves as you around who will be in the White tion, or law firm through a staffing move from consultancy to corpora- House in 2021, it may be years agency; and/or two, they need to tion is often a false one. Every com- before meaningful federal legisla- scale quickly when bidding on and pany, regardless of size, holds a tion is passed to supersede the cur- winning business that changes the different standard and expectation rently fragmented state data privacy entire scope of necessary human related to quality of life. Lawyers laws. As a result, expect plenty of capital needed to execute on new working at law firms who are work for privacy lawyers in the engagements. beholden to the billable hour model future–direct-hire, contract-to-hire, Smaller companies often win gov- likely maintain the lowest work/life and contract only. ernment bids for contracts related balance, but some vendors have Another event that will impact the to building privacy programs within better balance than some privacy job market is the imminent LJN’s Cybersecurity Law & Strategy September 2019 evolution of privacy leaders. The professionals are rapidly evolving Final Thoughts primary agenda for most newly toward serving goals broader than The privacy profession is just get- minted CPOs in the last three years privacy to help innovate and drive ting started. Expect the evolution of has been to build a privacy pro- businesses forward by smartly seasoned privacy talent and their gram, driven largely by the require- managing data. Expect new roles matriculation into tertiary fields like ments of GDPR. Many organizations that did not exist (like Data Strat- data governance, security, risk, or that did not have a privacy program egy and Policy Officer in corporate policy to create room for vertical prior to GDPR have one now, but or Practice Innovation Officer in growth of incumbents across the many of the CPOs who built those Am Law) to continue to evolve and privacy ecosystem who hold official programs have more to offer than become available. For many, these or unofficial deputy-like titles. the maintenance and gradual will be new roles, without prede- Expect most staffing to occur in the enhancement of the in-house pri- cessors, some hired from within, middle of the market, with semi- vacy program and policies. Some others externally. seasoned privacy professionals with CPOs are shifting upstream and Another possible disruption to three to seven years’ experience, becoming CDOs (Chief Data Offi- the current state of the privacy lawyers or not, to be highly desired cers) due to the success of the market would be the emergence of and earning between $100 and GDPR program development and a dominant software technology $200K base compensation annually, the insight into corporation data- that forces talent proliferation of depending on the role. Expect tech- leveraging opportunities that the skills in that technology. While nology skill sets to play an increas- GDPR build exposed. many would argue that the core ingly important role in how hiring The focus of many privacy pro- principles of privacy are tool- managers evaluate privacy talent, fessionals is going to shift away agnostic, professionals in the e-dis- from pure compliance and regula- covery vertical (for example) might especially for the higher paid and tory work and move to the moneti- argue the same; however, in the harder to fill privacy engineer roles. zation and strategic use of data to e-discovery war for the talent, one Expect professionals who do some benefit the business. Leveraging dominant software — Relativity — privacy work in their current role to data to benefit brand success plays a key role in how hiring man- shift focus to become fully-fledged sounds more like an information agers hire and assess talent. Right privacy pros! Expect the future state governance agenda than a privacy now, IAPP certifications hold a of the U.S. privacy job market to be program responsibility, which similar dominance and credibility healthy and hearty. points to the shifting leadership for privacy hiring managers, but in role in the dance between corpo- no way are they tool-specific in rate privacy and information gov- training and education. According ernance professionals, and privacy to the IAPP: “Nearly one in three —❖— pros may now be taking the lead. privacy professionals holds a The regulatory pressures and CIPP/E certification from the IAPP, requirements of GDPR compliance up a remarkable 11% from 2017.” forced a maturing of broader infor- While a “silver bullet” technology is mation governance policies and not likely to replace the necessary procedures, centered specifically frameworks surrounding what is on privacy. These corporate opera- considered essential privacy skill tions are now evolving to serve the sets, it is possible a tool may Rachael Haher organization in ways beyond GDPR become so prevalent in this market Business Development Manager compliance. Many companies that hiring managers begin looking TRU Staffing Partners lacked commitment and invest- for plug-and-play talent that can P: 718-541-3630 ment in operationalizing broad wield that technology for instant E: [email protected] information governance initiatives augmentation. No one predicted Reprinted with permission from the September 2019 edition of because these programs were that would happen in e-discovery, the Law Journal Newsletters. © 2019 ALM Media opportunistic, not mandated. That but it did, and it remains a primary Properties, LLC. All rights reserved. Further duplication without permission is prohibited. For information, contact 877.257.3382 changed with GDPR, and privacy hiring protocol. or [email protected]. # LJN-08272019-413926-TRU