Associate Vice President, Legal – Privacy, Cybersecurity & AI Governance

At Bath & Body Works, we believe everybody deserves to feel good. When you join us, you're part of more than an iconic fragrance and personal care brand — you become part of Gingham Nation, where people are at the center of everything we do.

We believe great associate experiences create great consumer experiences. When our associates feel supported, inspired and empowered, consumers feel it. Whether you're starting your career or building your next chapter, we invest in your growth so you can learn, lead and help create feel good moments every day.

The Associate Vice President, Legal – Privacy, Cybersecurity & AI Governance leads the company’s domestic and international privacy, data governance, cybersecurity legal, and artificial intelligence governance programs. This role provides practical legal counsel, strengthens enterprise risk management, and partners across the business to enable responsible data use, automation, and innovation.

Responsibilities

· Privacy and AI Governance\: Lead and continuously improve privacy, data, and AI governance programs in alignment with business priorities, legal requirements, and recognized frameworks, including NIST.

· Legal Counsel and Risk Management\: Advise leaders on privacy, cybersecurity, AI, data use, automation, and emerging legal risks. Translate complex requirements into practical, business-oriented solutions.

· Policies and Assessments\: Develop and maintain policies, standards, procedures, and privacy and AI risk-assessment processes that identify, prioritize, and mitigate risk.

· Third-Party and Contract Risk\: Oversee privacy, cybersecurity, data protection, and AI reviews for vendors and commercial agreements. Maintain relevant contract terms and templates.

· Incident Response\: Direct legal support for data and cybersecurity incidents, including preparedness exercises, investigations, escalation, notification, reporting, and remediation.

· Data Subject Rights\: Oversee compliant and efficient data-subject-rights processes and supporting automation.

· Training and Awareness\: Deliver enterprise and role-based education that strengthens privacy, cybersecurity, and AI accountability.

· Litigation and Regulatory Support\: Provide subject-matter expertise for privacy-related disputes, investigations, litigation, and regulatory matters in partnership with internal and external counsel.

· Cross-Functional Partnership\: Partner with IT, Cybersecurity, Digital, Marketing, HR, and other functions to embed privacy and responsible AI into business processes and technology initiatives.

· Leadership Communication\: Present clear assessments, recommendations, and program updates to executive leaders and, as appropriate, the Board of Directors.

· Team and Resource Leadership\: Lead, develop, and retain a high-performing legal team while managing priorities, external counsel, and budget responsibly.