Data Protection Officer (DPO) / GRC Officer

What will you do at Fynd

Governance, Risk, and Compliance (GRC):

• Develop, implement, and maintain GRC frameworks to align with regulatory and industry standards.
• Establish risk assessment methodologies and ensure mitigation strategies are in place.
• Conduct IT General Controls (ITGC) assessments to ensure effective security controls and processes.
• Oversee third-party risk assessments, ensuring vendors comply with security policies.

Data Protection & Privacy Compliance:

• Implement and oversee compliance with DPDP (Digital Personal Data Protection Act, India) and GDPR regulations.
• Act as the point of contact for data protection authorities and internal privacy matters.
• Conduct Data Protection Impact Assessments (DPIAs) and privacy risk assessments.
• Develop and enforce privacy policies, data retention, and protection measures.

Information Security Compliance & Certifications:

• Lead and maintain compliance with ISO 27001, ensuring policies and controls meet certification requirements.
• Manage SOC 2 compliance efforts, including security, availability, processing integrity, confidentiality, and privacy principles.
• Oversee PCI-DSS compliance for handling cardholder data securely.
• Ensure alignment with NIST security frameworks for risk management and cybersecurity resilience.

Business Continuity & Incident Management:

• Develop and maintain a Business Continuity Management (BCM) program, including disaster recovery plans.
• Lead security incident response and investigations to mitigate data breaches and cybersecurity threats.
• Conduct regular tabletop exercises and audits to test resilience and readiness.

Some Specific Requirements

• Bachelor's/Master's degree in Information Security, Cybersecurity, Compliance, or a related field.
• Professional certifications such as CIPP/E, CIPM, CISSP, CISM, CISA, ISO 27001 Lead Auditor, or CRISC are highly preferred.
• 5+ years of experience in Data Protection, Compliance, GRC, or Cybersecurity roles.
• Strong knowledge of regulatory frameworks (SOC2, ISO27001, GDPR, DPDP, PCI-DSS, NIST, ITGC, Third-Party Risk Management).
• Experience in implementing GRC tools and automating compliance processes.
• Excellent stakeholder management skills with the ability to work cross-functionally.
• Strong analytical, problem-solving, and decision-making skills.