Senior Data Privacy & Compliance Lead – Crypto

VALR; South Africa; On-site; ZAR 900,000 - 1,800,000; Full time

Job summary

VALR, a Johannesburg-based global crypto exchange, is seeking an Information Security, Privacy and AML compliance lead with 8+ years of experience. You will maintain POPIA/GDPR compliance, oversee KYC and data protection, and advise on privacy risk across engineering, product and risk teams.

The role requires certifications such as CIPP/E or CIPM and CAMS/CCAS, familiarity with FIC FATF Travel Rule, and practical incident response experience.

Qualifications

• At least 8 years’ experience in data privacy and protection and AML compliance, preferably at a crypto asset service provider, fintech or financial institution.
• A relevant diploma, degree or equivalent practical experience in Information Security, Law, Compliance or Risk.
• A recognised privacy certification (e.g. CIPP/E, CIPM) and AML certification (e.g. CAMS, CCAS).
• Strong knowledge of POPIA, PAIA and GDPR, including Information Regulator requirements and the role of Information Officers and Deputy Information Officers.
• Strong knowledge of AML/CFT frameworks, including the FIC Act, FATF standards for virtual assets and VASPs, and the Travel Rule.
• Working knowledge of cybersecurity principles, including authentication, MFA, IAM, encryption, access control, DLP, logging, cloud security and incident response.
• A keen interest in Artificial Intelligence and its privacy and data governance implications.
• Advantageous: experience across VALR’s jurisdictions – South Africa (FIC Act, FAIS; Information Regulator, FIC, FSCA), Africa (e.g. Kenya’s Data Protection Act and VASP Act), Europe (MiCA, EU AML framework) and the Caribbean (Cayman Islands Data Protection Act, AML Regulations and Virtual Asset (Service Providers) Act; CIMA).

Responsibilities

• Maintain VALR’s POPIA compliance framework and PAIA manual, and act as the contact point for the Information Regulator, other supervisory authorities and data subjects.
• Inform and advise the business and staff on their POPIA and GDPR obligations, monitor compliance, and report on privacy risk and compliance status to executive leadership.
• Oversee data subject requests, PAIA requests involving personal information and other privacy rights within statutory timeframes.
• Govern cross-border transfers and disclosures of personal information to third parties.
• Ensure KYC, CDD, enhanced due diligence, transaction monitoring and blockchain analytics data is collected, used, shared and retained lawfully under both AML and data protection laws.
• Govern Travel Rule data exchanged with counterparty VASPs and reconcile AML record-keeping periods with data retention requirements.
• Support the MLCO/MLRO on STR confidentiality and preventing tipping off.
• Manage VALR’s DPIA and security risk assessment processes for products, systems, vendors and processing activities, maintain the risk registers and track remediation.
• Escalate material privacy or security risks where controls are inadequate or remediation is outstanding.
• Oversee Data Loss Prevention (DLP) controls, segregation of customer personal data between administrative and standard user environments and devices, and separation of privileged, administrative and standard access roles.
• Work with Engineering, Product, Risk and Security to embed privacy by design and by default (data minimisation, access restriction, retention and secure handling), including reviews of architecture, data flows, APIs, databases, cloud services and integrations.
• Draft and maintain privacy and security policies, standards and procedures, and keep evidence of compliance.
• Monitor changes in privacy, data protection, cybersecurity and AML law, guidance and standards, and assess their impact on VALR.
• Deliver practical privacy and cybersecurity advice and training to staff and business teams.

Skills

Privacy compliance

AML compliance

Regulatory knowledge

Data protection

Cybersecurity basics

Privacy certifications

Risk management

Education

InfoSec/Law/Compliance degree

Tools

CIPP/E

CIPM

CAMS

CCAS

Job description

VALR, a Johannesburg-based global crypto exchange, is seeking an Information Security, Privacy and AML compliance lead with 8+ years of experience. You will maintain POPIA/GDPR compliance, oversee KYC and data protection, and advise on privacy risk across engineering, product and risk teams.

The role requires certifications such as CIPP/E or CIPM and CAMS/CCAS, familiarity with FIC FATF Travel Rule, and practical incident response experience.