AVP - Data Protection (Technical)

SMBC Group; New Delhi; On-site; INR 900,000 - 1,300,000; Full time

Job summary

SMBC Group is seeking a privacy and data protection professional to assist the DPO in operationalizing privacy and information security requirements in Delhi. You will support DPDP compliance, data classification and incident coordination across multiple systems and vendors.

The role emphasizes risk assessment, DPIAs, documentation and dashboarding to enable governance forums and remediation tracking, with collaboration across stakeholders and control owners.

Qualifications

• Knowledge of DPDP, GDPR and data privacy principles.
• Experience with privacy risk assessments and DPIAs (privacy impact assessments).
• Understanding of data classification, retention, access controls and encryption.
• Ability to document controls and support governance reporting and remediation tracking.

Responsibilities

• Support monitoring and implementation of privacy and information security controls for personal data processing.
• Support DPDP and other privacy compliance activities, including checklists and remediation follow-up.
• Assist privacy risk assessments and DPIAs for systems, applications and vendors.
• Support data classification, access control, encryption, retention and deletion controls.
• Assist in privacy incident response and DPO updates.

Skills

DPDP/GDPR knowledge

Privacy risk assessment

DPIA/PIA

Data classification/retention

Incident management

Stakeholder coordination

Education

Graduate or post-graduate in relevant field

Certifications (CIPP/CIPM/CIPT/CISSP/ISO27001)

Job description

Support the Data Protection Officer (DPO) in operationalizing and monitoring privacy, data security and information security requirements. The role will assist with DPDP and other privacy compliance activities, data protection controls, security-related privacy assessments, privacy incident coordination, data classification and retention, control testing, dashboards and remediation tracking.

Primary responsibilities

• Support monitoring and implementation of privacy, data security and information security controls relevant to personal data processing, storage, transfer, access, retention and disposal.
• Support DPDP and other applicable data protection compliance activities, including operational checklists, control mapping, documentation and remediation follow-up.
• Conduct or support security-related privacy risk assessments and DPIAs for systems, applications, processes, vendors and technology changes involving personal data.
• Support data classification, access control, encryption, masking, anonymization, retention, deletion and other technical or procedural data protection controls in coordination with control owners.
• Assist in privacy and information security incident response, including initial fact collection, impact assessment support, case documentation, remediation tracking and preparation of DPO updates.
• Support third-party privacy and security assessments, due diligence reviews and monitoring of data protection requirements for vendors and service providers.
• Prepare privacy / security metrics, dashboards, control testing results and awareness materials for DPO and governance forums.

Knowledge, Skills, Experience & Qualifications

• Knowledge Requirements: Working knowledge of DPDP, GDPR, data privacy principles, data security and information security controls, privacy risk assessment, DPIA / PIA, data classification, retention, access management, encryption, masking, anonymisation, incident management, third-party risk and security governance frameworks.
• Specialist / technical skills: Privacy and security control assessment; GRC and evidence management; data classification and retention; incident documentation; risk and control mapping; technical documentation; dashboard preparation and remediation tracking. Familiarity with ISO 27001, NIST or similar frameworks and privacy / security tools is desirable.
• Behavioural / management skills: Analytical thinking, attention to detail, written and verbal communication, documentation discipline, stakeholder coordination, confidentiality, ownership and ability to work under the guidance of the DPO.
• Education & Qualifications: Relevant Graduate or post-graduate qualification. Relevant certifications such as Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM), Certified Information Privacy Technologist (CIPT), Certified Information Systems Security Professional (CISSP), ISO 27001, Security+, or equivalent may be preferred depending on grade.