Data Protection Officer - FinTech

Yello; Abu Dhabi; On-site; AED 140,000 - 210,000; Full time

Job summary

Yello in the United Arab Emirates seeks a senior privacy and data governance leader to design and operate the privacy program across cloud services, AI/ML workflows and product deployments.

You will partner with Tech, Information Security, Legal and Operations to embed privacy-by-design, perform DPIAs and RoPA, conduct data mapping, retention controls, and incident response, while ensuring audits and regulatory readiness.

Qualifications

• At least 7 years in data protection, privacy, information security or data governance in tech-based or fintech environments.
• IT/cybersecurity or technical data governance background is essential.
• Hands-on design and operation of privacy and data protection controls across cloud services, apps, APIs or data platforms.
• Experience delivering data mapping, RoPA, DPIAs, data subject rights, retention controls and privacy incident support.
• Practical privacy-by-design experience within cloud-native architectures and software/product development processes.
• Experience addressing data protection risks in AI/ML workflows and AI services.
• Experience in fintech or regulated environments preferred.
• Privacy qualifications (CIPP/E, CIPM, etc.) advantageous but not required.

Responsibilities

• Build and operate the privacy and data governance programme, including its policies, standards, procedures, controls and operating cadence.
• Own data mapping and RoPA across cloud services, data platforms and AI/ML workflows.
• Lead DPIAs and data-related risk assessments for products and AI use cases.
• Embed privacy-by-design within technology architecture, SDLC/CI-CD and data lifecycle.
• Implement practical controls for data minimisation, access, logging, classification, retention and transparency.
• Establish and manage data subject rights operations with identity verification and audit trails.
• Support privacy incident response and breach notification activities across teams.
• Manage privacy controls for vendors, cloud providers and AI partners, including due diligence and monitoring.
• Maintain programme metrics and evidence for audits and regulatory readiness.

Skills

Privacy engineering

Data protection

Information security

Data governance

Risk assessment

DPIAs

Data mapping

Education

IT / cybersecurity degree

Tools

Cloud platforms

Data platforms

AI/ML security

Job description

A growing firm in the Middle East.

• Build and operate the privacy and data governance programme, including its policies, standards, procedures, controls and operating cadence.
• Own data mapping and Records of Processing Activities across cloud services, data platforms and AI/ML workflows.
• Lead Data Protection Impact Assessments and data related risk assessments for products and AI use cases.
• Work directly with Tech and Information Security teams to embed privacy-by-design within technology architecture, SDLC/CI-CD and the data lifecycle.
• Implement practical controls covering data minimisation, access, logging, classification, retention, deletion and transparency.
• Establish and manage data subject rights operations, including identity verification, fulfilment, audit trails and service levels.
• Support privacy incident response and breach notification activities alongside Information Security, Legal and Operations.
• Manage privacy controls for technology vendors, cloud providers and AI partners, including due diligence and ongoing monitoring.
• Maintain programme metrics and evidence to support audits, regulatory readiness, security questionnaires and institutional-client due diligence.

• At least 7 years' experience in data protection, technical privacy, information security or data governance within a technology led or Fintech environment.
• An IT, cybersecurity, information security or technical data governance background is essential.
• Hands-on experience designing and operating privacy and data protection controls across cloud services, applications, APIs or data platforms.
• Experience delivering data mapping, RoPA, DPIAs, data subject rights processes, data classification, retention controls and privacy incident support.
• Demonstrable experience working directly implementing controls.
• Practical experience of privacy-by-design within cloud-native architectures and software or product development processes.
• Tangible experience addressing data protection and governance risks associated with AI/ML workflows, AI-enabled products or third-party AI services.
• Experience in fintech, financial services, payments or another regulated or high-trust environment is preferred.
• Privacy qualifications such as CIPP/E, CIPP/US or CIPM are advantageous but will not replace the required technical background.