Senior IT Security Officer (Data Protection)

Develop and update data protection policies and procedures: Establish and regularly update a comprehensive data protection framework (policies, guidelines, processes) to ensure ongoing compliance with Vietnamese laws and regulations (e.g. the Data Law 2024, PDPL and Decree 13 on Personal Data Protection).
Compliance monitoring and enforcement: Monitor the organization's data handling activities and enforce compliance with personal data protection requirements. Conduct periodic audits and assessments of data processing practices, identifying gaps and implementing improvements or corrective actions.
Cross-departmental support and advisory: Advise and support internal teams (e.g. IT, Product, Operations, Legal, Compliance ...) in designing and implementing data management and protection solutions. This includes embedding privacy and security controls into new projects ("privacy by design") and guiding teams on proper handling of customer and employee data in critical information systems.
Data Protection Impact Assessments: Coordinate and perform Data Protection Impact Assessments (DPIAs) and other risk assessments for projects or initiatives involving personal or sensitive data. Recommend risk mitigation strategies and ensure that high-risk data processing activities are identified and approved in accordance with legal requirements.
Documentation and reporting: Maintain comprehensive documentation related to data protection efforts, including records of data processing activities, DPIA reports, consent records, and data protection policies/procedures. Prepare regular compliance reports for management and contribute to any regulatory reporting or certification processes regarding data privacy.
Personal Data protection: Conduct first-level reviews of DPAs, privacy assessments and vendor privacy evaluations. Serve as point of contact for personal data protection authorities. Collect, analyse, buidl-up report related to personal data protection for IT Security.
Promote a culture of personal data protection and compliance across all units of the organization.
Do others jobs assigned by Manager/Director.