Senior Commercial Counsel

About Us

At Rox , we believe in empowering people to do their best work.

Our platform supercharges sellers with autonomous revenue agents to do the manual work so they can focus on what they do best: selling. Just as coding agents 10x’d engineering, revenue agents 10x customer work.

We are reimagining the revenue stack by building the world’s first revenue operating system, from the application layer to the system of context. With Rox, humans are evolving to orchestrators while agents manage the end-to-end customer lifecycle.

Rox powers Global 2000 leaders in banking, hardware, construction, and sovereign AI, while serving dominant AI winners like Ramp and Cognition.

Underlying all of this success is an unwavering, shared belief in the mission, with an unreasonable commitment of doing whatever it takes to make it a reality.

The Team

Nothing is possible without the world-class team, assembled to redefine how businesses operate.

Members on our team have:

Founded and exited successful companies

Held the highest positions at Google, AWS, Confluent, and New Relic

Won IMO and IOI gold medals

Published field-defining papers

We’re backed by the best, including Sequoia, General Catalyst, Google Ventures, Elad Gil, and Chris Ré.

Core Principles

Taste: Craft beautiful experiences.

No matter how small, we strive to make sure every detail is right. We care deeply about every interaction, both in terms of whether it helps the seller get the job done, but also how the product makes them feel. We get a visceral feeling when something is off and stop at nothing to make sure we make it right. We never settle, continuously exploring ways to delight sellers.

Obsession: Commit unreasonably.

In all aspects of our craft, we commit. We not only are immediately reactive to customers’ requests but are proactive about driving value even before they ask. We are also obsessive about always learning and honing our craft, improving ourselves and product every single day.

Action: Get it done.

Talking is easy but the difference comes from the execution. We lean heavily towards making thoughtful yet fast decisions and delivering immediately. We play in a field where trust is paramount. We earn the trust and right to empower the best sellers by forging a history of over-delivering on the promise at record speed.

Your Role

As Senior Commercial Counsel at Rox, you’ll be our first in-house lawyer. Our product sends email, places calls, researches companies and people across the public web, and acts inside our customers’ CRMs on their behalf, all of it driven by large language models. Our customers are Global 2000 enterprises in regulated industries, and the people our agents reach sit in the US, EU, UK, Canada and APAC. That combination produces legal questions with no settled playbook: who is the controller for enriched contact data, what an autonomous outbound agent must disclose, how responsibility splits when the product runs inside a customer’s own cloud. You’ll work them out, with outside counsel where the law is unsettled, and turn the answers into agreements, policies and product requirements that scale.

You’ll own commercial contracting end to end, run our privacy and communications-compliance programs day to day, and work closely enough with product and engineering to shape features before they ship. Outside general counsel and privacy counsel cover corporate matters and back you on novel questions. This is the first seat in a legal team that will grow with the company. If you’re energized by hard questions at the intersection of enterprise contracting, data privacy and AI, and by the pace of an early-stage company selling to the largest enterprises in the world, we’d love to talk.

Responsibilities

Own commercial contracting end to end: MSAs, order forms, SOWs, DPAs, security addenda, NDAs and pilot agreements, from first draft through negotiation with Global 2000 legal and procurement teams to signature

Build the templates, playbooks and fallback positions that let Sales and Growth close standard deals without a lawyer in the room, and route the exceptions that need one to you

Set and defend Rox’s data privacy positions across GDPR and UK GDPR, CCPA/CPRA and the other US state laws, PIPEDA and APAC regimes: controller, processor and subprocessor roles across our product, our data and inference providers and customer integrations; cross-border transfers; retention; DPIAs. Run the subprocessor management program across enterprise DPAs with differing notice and consent terms

Own communications compliance for a product that outbounds on behalf of sellers: CAN-SPAM, TCPA, CASL, ePrivacy and PECR, state telemarketing and call-recording laws, do-not-call, consent and suppression. Define what the product enforces by design and what customers warrant, and put both into our agreements and our features

Own AI governance: EU AI Act obligations, US state AI laws, bot and automated-communication disclosure rules, FTC guidance on AI claims, and model provider terms. Work out, with outside counsel where the law is unsettled, what Rox commits to on training, data retention, output ownership and indemnification, and keep the AI Use Policy and customer-facing AI documentation current

Counsel product and engineering on features and integrations before launch: data flows for the Outbound Agent, Sequences and the dialer, agentic web research, call recording and transcription, CRM and communication-platform integrations and their third-party terms, and customer-hosted (in-VPC) deployments with their shared-responsibility model

Negotiate inbound agreements with data, inference, telephony and cloud vendors, and structure partner, reseller and cloud marketplace agreements as the partner ecosystem grows

Partner with Security on SOC 2, ISO 27001 and NIST alignment, security questionnaires, incident response and breach notification obligations

Coordinate outside counsel on corporate matters (fundraising diligence, IP and trademark, open source compliance) and train the go-to-market and forward deployed engineering teams on contracting and compliance guardrails

Qualifications

JD and active membership in good standing with at least one US state bar; California preferred

4 to 8 years of legal practice, including at least 2 years in-house at a B2B SaaS or enterprise software company or in a technology transactions practice serving them; experience with products that handle customer data at scale or build on large language models is a strong plus

Has taken large, complex, heavily negotiated MSAs, DPAs and security addenda with Fortune 500 or Global 2000 legal and procurement teams from first redline to signature, and knows when to hold a position and when to trade it

Practical command of data privacy law in the US (CCPA/CPRA and other state statutes) and the EU and UK (GDPR, UK GDPR, ePrivacy), including cross-border transfer mechanisms and controller/processor analysis; Canada (PIPEDA, CASL) and CIPP/E or CIPP/US a plus

Working knowledge of marketing and communications compliance: CAN-SPAM, TCPA and state telemarketing and call-recording laws, and the operating practices (consent, suppression, do-not-call, disclosure) that keep automated outreach compliant; CASL and PECR a plus

Working knowledge of AI regulation and standards (EU AI Act, US state AI laws, NIST AI RMF) and a solid understanding of how the technology works: inference, context windows, retrieval, agents