Data Protection Officer & Cyber Security Lead

Cloudstaff; Philippines; On-site; PHP 1,800,000 - 2,400,000; Full time

Job summary

Cloudstaff in the Philippines is seeking a Data Protection Officer & Cyber Security Lead to govern privacy, data protection, and security across the clinics.

You will lead NPC compliance, manage data processing systems, implement privacy by design, and oversee cyber security programs, including risk assessments, incident response, and staff training.

Qualifications

• 10+ years in a regulated industry.
• Accountable for data protection with proven compliance leadership.
• Recognised data protection qualification (NPC DPO ACE, CIPP/A, CIPM or CIPT).
• Can apply the Data Privacy Act of 2012, its IRR and NPC issuances to practical cases.
• Explain common cyber security controls and how to respond to security incidents.
• Hands-on work experience, not just management.
• Able to explain risk to executives and influence decisions.
• Experience using AI tools or AI-enabled processes to improve operations.
• Healthcare industry experience (Desirable).
• Cyber security responsibility in a previous role (Desirable).

Responsibilities

• Lead data protection and privacy program for clinics and staff.
• Oversee cyber security governance, risk management, and controls.
• Coordinate with Office of the CEO, IT, and legal counsel.
• Ensure NPC registrations and DPIA processes are maintained.
• Lead staff training on privacy and security.

Skills

Data protection

Cyber security

Compliance

AI-enabled tooling

Stakeholder communication

Regulatory awareness

Incident response

Training & awareness

Education

Bachelor's degree in IT/CS/Engineering

Job description

We are currently on the lookout for a new Data Protection Officer & Cyber Security Lead to join our team at Cloudstaff, the #1 Workplace Everywhere!

Reports to: Office of the CEO (line manager). Functional reporting to IT for cyber security operations.

Purpose of the role:

• The organisation provides surgical and non-surgical medical aesthetic treatments through a growing network of clinics. Its patients include high-profile individuals and international patients.
• This role has two accountabilities: data protection and cyber security. You are the Data Protection Officer and the accountable lead for cyber security. Both accountabilities protect the same assets: patient health and treatment data, patient confidentiality, and the clinical and business systems that the clinics depend on.
• The role covers operation and assurance. You do the work, and you check that controls and processes work as intended.

Regulatory commitment:

• The organisation complies with the Data Privacy Act of 2012, its Implementing Rules and Regulations and issuances of the National Privacy Commission. This covers DPO designation, registration of data processing systems, security of personal data and personal data breach management. You are accountable for maintaining this compliance.
• As in the rest of the business, the organisation leads rather than lags. You will go beyond minimum compliance and set the standard for data protection and cyber security in medical aesthetics in the Philippines.

Accountability 1: Data protection

• DPO registration and the registration of all data processing systems with the NPC are complete and current. You are the contact point for data subjects and the NPC.
• The record of processing activities is accurate, including systems, data flows and where data is hosted. Transfers of personal data outside the Philippines are controlled.
• New and changed systems, services, suppliers and clinics are assessed through Privacy Impact Assessments and built with privacy by design.
• Every processing activity has a lawful basis, a clear purpose, valid consent where required, and uses only the data it needs.
• Data subject requests and complaints are handled from receipt to closure within the required timeframes.
• Third parties that process personal data are covered by suitable data sharing or outsourcing agreements and comply before and during the contract.
• Personal data breaches are assessed, notification decisions are made, and reports reach the NPC and affected data subjects within the required timeframes.
• The privacy manual, privacy notices, retention rules and policies are current. Compliance is monitored and audited, corrective actions are closed, staff are trained, and Compliance Officers for Privacy are supervised where appointed.

Accountability 2: Cyber security

• Cyber security risk is known, assessed and treated through the cyber risk register and the security roadmap.
• Security policies and standards are current and aligned to a recognised framework such as ISO/IEC 27001 or the NIST Cybersecurity Framework. The information asset register is complete.
• Systems, cloud, network, endpoints, email, backup and logging meet the organisation's security requirements, including new systems, major changes and new clinics before go-live.
• Access to systems and data is controlled, including privileged access, joiners, movers and leavers, and regular access reviews.
• Vulnerabilities are controlled through patching, vulnerability assessments and penetration tests, with remediation tracked to closure.
• Security incidents are detected, contained and recovered from quickly, using tested response plans, so that clinical and business systems stay available.
• Suppliers meet the organisation's security requirements before contract, in contract terms and at each review.
• Security controls are tested to confirm they work as intended, and staff security awareness is built through training and phishing exercises.

Operating model:

• Data protection
  • You lead data protection directly. You work with business owners, IT and legal counsel, and supervise Compliance Officers for Privacy where appointed.
• Cyber security
  • The organisation has a strategic engagement with a qualified third party that provides cyber security resources, expertise and oversight. In the long term, this engagement will provide around 50% of cyber security resources. In the interim, additional cyber security capacity is likely to be agentic. You remain accountable for cyber security and work with the third party and IT.
• Ways of working
  • Across both accountabilities, you improve processes and apply AI-enabled tools and automation where they add value.
• Reporting
  • You report on data protection and cyber security risk and performance to the Office of the CEO, and on cyber security operations to IT.
• Growth and learning
  • The medical aesthetics field is growing, and the organisation is growing with it. You will learn and grow with the business.
  • AI brings new challenges for both data protection and cyber security. You will build capability in this area and keep a good understanding of new technology trends. Beginning to understand medical technology would be very helpful.

Essential

• At least 10 years' working experience in a regulated industry.
• Experience in a role where you were accountable for data protection. You can give examples of compliance you maintained, assessments you led, and breaches or requests you handled.
• A recognised data protection qualification, for example NPC DPO ACE, IAPP CIPP/A, CIPM or CIPT.
• You can apply the Data Privacy Act of 2012, its IRR and NPC issuances to practical cases.
• You can explain common cyber security controls and how you would respond to a security incident.
• You can show hands-on work you did yourself, not only work you managed. This is not a hands-off role.
• You can give examples of explaining data protection and cyber security risk to business executives and influencing their decisions.
• You can give examples of using AI tools, automation or AI-enabled processes to improve and operate processes.

Desirable

• Healthcare industry experience.
• Cyber security responsibility in a previous role.

Education

• A bachelor’s degree in information technology, computer science, computer engineering or a related field.

Soft skills

• Customer service: you are helpful and respond quickly to clinic staff and colleagues.
• Communication: you speak and write clearly, and explain technical issues in simple language.
• Teamwork: you work well with people from different teams and backgrounds, and share information.
• Tact and courtesy: you stay calm and polite, especially when staff are under pressure.
• Initiative: you plan and do your work without detailed instructions, and suggest improvements.
• Organisation: you manage several tasks at once and set the right priorities.
• Flexibility: you are open to change and adjust quickly when the business needs it.