Data Protection Officer - Internal Audit

Al Khayyat Investments (AKI); United Arab Emirates; On-site; AED 180,000 - 300,000; Full time

Job summary

Al Khayyat Investments seeks a Data Protection Officer to lead data protection and privacy activities across the Group. The role requires a technically strong professional with hands-on experience in IT audit, information security, technology compliance, data protection, and privacy governance.

The DPO will conduct risk assessments, DPIAs, and audits of IT general controls, vendor arrangements, and data processing activities, while delivering privacy training and ensuring compliance with UAE

Qualifications

• Bachelor's degree or higher in Information Technology, Computer Science, Information Security or a related field.
• 2–3 years of experience in IT internal audit, information security audit, technology compliance, or consulting.
• Hands-on audit experience is essential.
• Knowledge of ISO 27001, COBIT, NIST CSF, UAE PDPL, ADHICS, KSA PDPL/SDAIA, Oman PDPL, GDPR, ISO/IEC 27701, or NIST Privacy Framework.

Responsibilities

• Lead data protection and privacy activities across group operations and support functions.
• Ensure alignment with data protection policies, data classification standards, and applicable regulations.
• Support data governance activities, including data classification, labelling, and Records of Processing Activities.
• Conduct risk assessments, DPIAs, transfer impact assessments, and maintain the privacy risk register.
• Perform audits covering IT General Controls, information security, cyber security, data processing activities, systems, vendors, and third parties.
• Review vendor arrangements, data processing agreements, and privacy due diligence requirements.
• Support personal data breach response, including investigation, impact assessment, and regulatory notification.
• Deliver data protection awareness and training across the organisation.
• Work closely with Internal Audit, IT, and business teams to assess controls across ERP, CRM, HR, e-commerce, SaaS platforms, and emerging technologies.

Skills

IT audit

information security

privacy governance

data protection

technology compliance

report writing

stakeholder management

communication skills

Education

Bachelor's degree in IT/CS/Info Security

Tools

SAP

Oracle

Microsoft Dynamics

Cloud platforms

SaaS apps

Job description

Al Khayyat Investments is looking for a Data Protection Officer to lead data protection and privacy activities across the Group.

This role is suitable for a technically strong professional with experience in IT audit, information security, technology compliance, data protection, and privacy governance.

Key Responsibilities

• Lead data protection and privacy activities across group operations and support functions.
• Ensure alignment with data protection policies, data classification standards, and applicable regulations.
• Support data governance activities, including data classification, labelling, and Records of Processing Activities.
• Conduct risk assessments, DPIAs, transfer impact assessments, and maintain the privacy risk register.
• Perform audits covering IT General Controls, information security, cyber security, data processing activities, systems, vendors, and third parties.
• Review vendor arrangements, data processing agreements, and privacy due diligence requirements.
• Support personal data breach response, including investigation, impact assessment, and regulatory notification.
• Deliver data protection awareness and training across the organisation.
• Work closely with Internal Audit, IT, and business teams to assess controls across ERP, CRM, HR, e-commerce, SaaS platforms, and emerging technologies.

Requirements

• Bachelor's degree in Information Technology, Computer Science, Information Security, or a related field.
• 2–3 years of experience in IT internal audit, information security audit, technology compliance, or consulting.
• Hands-on audit experience is essential.
• Knowledge of ISO 27001, COBIT, NIST CSF, UAE PDPL, ADHICS, KSA PDPL/SDAIA, Oman PDPL, GDPR, ISO/IEC 27701, or NIST Privacy Framework.
• Experience with enterprise systems such as SAP, Oracle, Microsoft Dynamics, cloud platforms, or SaaS applications.
• Strong report-writing, communication, and stakeholder management skills.

Preferred

• CIA, CISA, ISO 27701 Lead Implementer/Auditor, or equivalent certification.
• Experience in a large, diversified, or multi-entity organisation.
• Familiarity with GRC platforms and AI governance concepts.