Data Protection and Compliance Officer

Vudoo; Melbourne; On-site; AUD 120,000 - 180,000; Full time

Job summary

Vudoo, founded in Melbourne and serving a global client base, seeks a Data Protection and Compliance Officer to oversee privacy, security and AI governance programs. You will own ISO 27001 and ISO 42001 programs, drive GDPR/commercial privacy compliance, and partner with engineering, legal and product teams to embed compliant practices.

You will champion risk-based controls, coordinate audits, and lead security awareness across a growing global team, ensuring responsible AI governance and data

Qualifications

• 4+ years' experience in information security, privacy, IT compliance or GRC.
• Hands-on experience implementing or maintaining an ISO 27001 ISMS and supporting certification audits.
• Working knowledge of GDPR and US privacy laws (e.g. CCPA/CPRA).
• Familiarity with ISO 42001 or AI governance frameworks or strong drive to build that expertise.
• Ability to translate regulatory requirements into practical controls for technical teams.

Responsibilities

• Own and maintain information security, privacy and AI governance systems, including policies and risk registers.
• Lead certification for ISO/IEC 27001 and ISO/IEC 42001 and future goals e.g SOC 2.
• Manage GDPR and US privacy law compliance across global footprint.
• Maintain operational procedures and controls with evidence tracking and remediation.
• Coordinate security assessments and AI system impact assessments for new/existing systems.
• Ensure access control, asset management and incident management policies are maintained.
• Coordinate internal audits and manage external certification and customer audits to close-out.
• Design and deliver security awareness training for the global team.

Skills

Information security

Privacy

GRC

Tools

ISO 27001 ISMS

ISO 42001

SOC 2

GDPR

Job description

In a world where every click risks losing a customer, Vudoo enables conversion at the point of inspiration. Our commerce media technology transforms ads and content into interactive storefronts allowing consumers to browse, add to cart, and purchase without leaving the experience.

Powered by a patent-pending tech stack, secure API infrastructure, and advanced analytics, Vudoo connects media exposure directly to commerce outcomes delivering closed-loop attribution and real-time intent data across display, video, CTV, and emerging channels.

Vudoo operates as the invisible layer powering "commerce everywhere" embedded across the open web and seamlessly integrated into the platforms, publishers, and technologies that brands already use.

Founded in Melbourne and operating globally across North America, EMEA, and APAC, Vudoo's award-winning technology has been used by leading brands including Monash University, Rip Curl, Nike, Westpac, and Flight Centre. At the same time, we work closely with a global ecosystem of publishers, platforms, and ad tech partners including Amazon, News Corp Australia, Val Morgan Digital, Yahoo, PubMatic, SeenThis, Index Exchange, and Interpublic Group to bring commerce into media at scale.

This is not a theoretical category. Vudoo is actively shaping how commerce media is bought, sold, and executed.

About the Role

Vudoo works with some of the world’s biggest brands, publishers and platforms, and they rightly expect the highest standards of privacy, security and responsible use and development of AI. As we grow globally, our certification and compliance requirements are growing with us.

As our Data Protection and Compliance Officer, you'll own the maintenance and reporting of Vudoo's privacy, security and AI governance systems. You'll lead our major certification programs, ISO 27001 and ISO 42001 (AI Management System)and our compliance with GDPR and US privacy laws, turning complex requirements into practical controls that enable the business to move quickly and safely.

What You Will Do

• Own and maintain Vudoo's information security, privacy and AI governance management systems, including policies, procedures, asset, regulatory compliance and risk registers and statements of applicability
• Lead certification and ongoing compliance for ISO/IEC 27001 (Information Security Management System) and ISO/IEC 42001 (AI Management System) and future goals e.g SOC 2
• Manage compliance with GDPR, US federal and state privacy laws, and other privacy regulations relevant to our global footprint (e.g Japan), including the Australian Privacy Act
• Maintain and monitor operational procedures and controls, tracking evidence and remediation
• Collaborate with System Administrators, DevSecOps Engineers, Software Engineering Delivery managers to develop and maintain change and operational procedures critical to security, privacy and AI compliance.
• Coordinate security assessments and AI system impact assessments for new and existing systems and features.
• Ensure access control, asset management, HR security, cryptography, supplier management and incident management policies and procedures are maintained, communicated and monitored.
• Coordinate internal audits and manage external certification and customer audits through to close-out.
• Design and deliver security awareness training across our global team and ensure Acceptable use of ICT equipment and AI systems is understood and implemented.
• Respond to customer and partner security, privacy and AI due diligence questionnaires
• Support third-party and vendor risk assessments, Report regularly to leadership on compliance posture, key risks and audit outcomes, Work closely with engineering, product, legal and people teams to embed compliance into how we work.
• Privacy operations, Data map, privacy impact assessments, data subject requests, breach notification (the Notifiable Data Breaches scheme, GDPR's 72-hour rule)
• Consent and tracking in ad products, identity and measurement partners
• Contracts, Data processing agreements and privacy terms in partner deals.

Who You Are

• 4+ years' experience in information security, privacy, IT compliance or governance, risk and compliance (GRC)
• Hands-on experience implementing or maintaining an ISO 27001 ISMS and supporting certification audits
• Working knowledge of GDPR and US privacy laws (e.g. CCPA/CPRA and other state laws)
• Familiarity with ISO 42001 or AI governance frameworks such as the NIST AI RMF or EU AI Act - or a strong drive to build that expertise
• Able to translate regulatory and standards requirements into practical, proportionate controls for technical teams
• Highly organised and detail-oriented, with the judgement to prioritise by risk
• Confident communicator and trainer who can influence stakeholders at every level
• A basic understanding of information systems, AI tools and software engineering.

It would be great if you also bring

• Certifications such as ISO 27001 Lead Implementer or Lead Auditor, CIPP/E, CIPP/US, CIPT, CISM or CISA
• Experience in SaaS, ad tech or data-driven businesses
• Experience with GRC or compliance automation platforms

Why Vudoo? What We Offer and what's in it for you

• An environment fostering independence, individualism, innovation and excellence
• Get to work with a kind, respectful and authentic global team
• An opportunity to write your story, compile everything you have learnt to have a meaningful impact on the future growth of some of the world’s biggest brands
• Be part of the Vudoo Strategic Growth plan, make a difference to our future footprint
• Work with an organisation who isn't afraid to do things differently and think outside the box