Practice Head – Data Security & Privacy

About the role

The Practice Head – Data Security & Privacy will act as the custodian of the organisation’s cyber security governance, data‑privacy compliance and technology risk management. Reporting to senior leadership, this role will design and operate the security governance framework, ensure compliance with the Digital Personal Data Protection Act (DPDPA) and embed security and privacy controls across all digital initiatives.

Key responsibilities

• Lead the DPDPA compliance programme, defining privacy‑by‑design principles, consent management, data retention, minimisation and data‑subject rights processes.
• Develop and maintain the enterprise information security governance framework, risk assessment methodologies and security policy standards.
• Own the IT GRC programme across applications, infrastructure, cloud and third‑party ecosystems, ensuring compliance with ISO 27001, SOC 2, NIST CSF and CIS Controls.
• Oversee cyber‑security assurance activities including vulnerability management, penetration testing, security assessments and architecture reviews for critical projects.
• Establish third‑party cyber‑risk assessment processes and define contractual security and privacy requirements for vendors and partners.
• Coordinate internal, external and customer audits, drive closure of findings and monitor remediation plans.
• Build and deliver organisation‑wide security and privacy awareness programmes, including phishing and data‑handling training.

Required profile

• 10‑15 years of experience in information security, IT risk, GRC or privacy.
• Proven track record leading ISO 27001, SOC 2, NIST or equivalent compliance programmes.
• Hands‑on experience with privacy regulations, particularly DPDPA.
• Strong ability to work with business and technology teams to embed security controls.

Required skills

• ISO 27001
• SOC 2
• NIST CSF
• CIS Controls
• DPDPA
• Data Protection Impact Assessment (DPIA)
• Vulnerability management
• Penetration testing
• Security assessments
• Security architecture review
• Third‑party risk assessment
• Audit management