Senior Data Protection Officer

This is a fully remote position, open to applicants in South Africa.

📋 Description

• Execute the duties of Information Officer and Data Protection Officer (DPO).

• Maintain VALR’s framework for compliance with POPIA and the PAIA manual, serving as the primary contact for the Information Regulator, other supervisory authorities, and data subjects.

• Provide guidance to the business and staff regarding POPIA and GDPR obligations, monitor compliance, and report on privacy risks and compliance status to executive leadership.

• Manage data subject requests, PAIA requests involving personal information, and other privacy rights within specified statutory timeframes.

• Oversee the governance of cross-border transfers and disclosures of personal information to third parties.

• Ensure that KYC, CDD, enhanced due diligence, transaction monitoring, and blockchain analytics data are collected, used, shared, and retained in compliance with legal standards.

• Govern the data exchanged under the Travel Rule with counterparty VASPs and reconcile AML record-keeping periods with data retention requirements.

• Assist the MLCO/MLRO in maintaining STR confidentiality and in preventing tipping off.

• Manage the DPIA and security risk assessment processes; maintain risk registers and track remediation efforts.

• Escalate significant privacy or security risks when controls are insufficient or remediation is pending.

• Oversee DLP controls, customer data segregation, and the separation of roles for privileged, administrative, and standard access.

• Manage the approval process for SaaS platforms, AI tools, browser applications, APIs, and integrations, reviewing security safeguards, privacy terms, DPAs, and sub-processors.

• Evaluate AI processing and monitor approved applications for significant changes in permissions, data access, or risk levels.

• Assess security incidents for their impact on personal information and lead necessary notifications to regulators and affected data subjects.

• Maintain records of incidents and breaches, tracking corrective actions taken.

• Collaborate with Engineering, Product, Risk, and Security teams to integrate privacy by design and default in architectures, data flows, APIs, databases, cloud services, and integrations.

• Draft and maintain privacy and security policies, standards, and procedures while retaining evidence of compliance.

• Stay updated on changes in privacy, data protection, cybersecurity, and AML laws, guidance, and standards, and evaluate their impact on VALR.

• Provide practical privacy and cybersecurity advice and training to staff and business teams.

⛳️ Requirements

• A minimum of 8 years of experience in data privacy and protection, as well as anti-money laundering (AML) compliance, with significant hands-on experience in both areas, ideally within a crypto asset service provider, fintech, or financial institution.

• A relevant diploma, degree, or equivalent practical experience in Information Security, Law, Compliance, or Risk.

• A recognized privacy certification (e.g., CIPP/E, CIPM) along with an AML certification (e.g., CAMS, CCAS).

• Strong understanding of POPIA, PAIA, and GDPR, including the requirements of the Information Regulator and the responsibilities of Information Officers and Deputy Information Officers.

• Comprehensive knowledge of AML/CFT frameworks, including the FIC Act, FATF standards for virtual assets and VASPs, and the Travel Rule.

• Familiarity with cybersecurity principles, such as authentication, MFA, IAM, encryption, access control, DLP, logging, cloud security, and incident response.

• A strong interest in Artificial Intelligence and its implications for privacy and data governance.

• Ideally, experience across VALR’s jurisdictions – South Africa (FIC Act, FAIS; Information Regulator, FIC, FSCA), Africa (e.g., Kenya’s Data Protection Act and VASP Act), Europe (MiCA, EU AML framework), and the Caribbean (Cayman Islands Data Protection Act, AML Regulations, and Virtual Asset (Service Providers) Act; CIMA).

🏝️ Benefits

• An innovative work environment with access to cutting-edge blockchain technologies and tools.

• Flexible work-from-anywhere policy with secure and stable internet connectivity.

• Annual professional development allowance.

• Scheduled company training sessions.

• Competitive salaries that align with industry standards.

• Discretionary bonuses.

• Preferential Tier 5 trading fees with no monthly trading volume requirements.

• Initiatives promoting diversity, equity, and belonging.

• Statutory leave as mandated by individual countries.

• Flexible leave options.

• Lunch provided for employees working from the Johannesburg Head Office.

• Social gatherings outside of work.

• Company retreats that combine professional development and team bonding activities.

• Provision of a Mac laptop.

• Discretionary allowance for home-office extras, with equipment retained after three years, subject to terms and conditions.