AVP - Data Protection (Technical)

Sumitomo Mitsui Banking Corporation

Purpose of the position

Support the Data Protection Officer (DPO) in operationalizing and monitoring privacy, data security and information security requirements. The role will assist with DPDP and other privacy compliance activities, data protection controls, security-related privacy assessments, privacy incident coordination, data classification and retention, control testing, dashboards and remediation tracking.

Primary responsibilities

1. Support monitoring and implementation of privacy, data security and information security controls relevant to personal data processing, storage, transfer, access, retention and disposal.
2. Support DPDP and other applicable data protection compliance activities, including operational checklists, control mapping, documentation and remediation follow-up.
3. Conduct or support security-related privacy risk assessments and DPIAs for systems, applications, processes, vendors and technology changes involving personal data.
4. Support data classification, access control, encryption, masking, anonymization, retention, deletion and other technical or procedural data protection controls in coordination with control owners.
5. Assist in privacy and information security incident response, including initial fact collection, impact assessment support, case documentation, remediation tracking and preparation of DPO updates.
6. Support third-party privacy and security assessments, due diligence reviews and monitoring of data protection requirements for vendors and service providers.
7. Prepare privacy / security metrics, dashboards, control testing results and awareness materials for DPO and governance forums.

Knowledge, Skills, Experience & Qualifications

• Knowledge Requirements: Working knowledge of DPDP, GDPR, data privacy principles, data security and information security controls, privacy risk assessment, DPIA / PIA, data classification, retention, access management, encryption, masking, anonymisation, incident management, third-party risk and security governance frameworks.
• Specialist / technical skills: Privacy and security control assessment; GRC and evidence management; data classification and retention; incident documentation; risk and control mapping; technical documentation; dashboard preparation and remediation tracking. Familiarity with ISO 27001, NIST or similar frameworks and privacy / security tools is desirable.
• Behavioural / management skills: Analytical thinking, attention to detail, written and verbal communication, documentation discipline, stakeholder coordination, confidentiality, ownership and ability to work under the guidance of the DPO.
• Education & Qualifications: Relevant Graduate or post-graduate qualification. Relevant certifications such as Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM), Certified Information Privacy Technologist (CIPT), Certified Information Systems Security Professional (CISSP), ISO 27001, Security+, or equivalent may be preferred depending on grade.