Data Protection Officer

Location: Ortigas (Onsite)

Schedule: Mid-shift

The Risk & Compliance Officer supports the organization by ensuring that all business process outsourcing (BPO) operations comply with regulatory requirements, client contractual obligations, data privacy standards, and internal risk controls. Reporting to the Head of Governance and Infrastructure, the role focuses on managing operational risks, monitoring compliance with industry best practices, and ensuring adherence to global client and local Philippine regulations. This position requires strong coordination with operations, HR, IT, legal, and client compliance teams.

QUALIFICATIONS:

• Bachelor’s degree in business, Law, Finance, Information Security, or a related field.
• 2 to 5+ years of experience in risk management, compliance, audit, or quality within a BPO organization.
• Knowledge of BPO operations, client SLA compliance, and process workflows.
• Strong understanding of:
• Data Privacy Act & NPC guidelines
• ISO 27001, SOC 2, or other InfoSec standards (a plus)
• Regulatory requirements affecting BPOs (labor, tax, data privacy)
• Strong analytical, documentation, and problem-solving skills.
• Excellent communication skills for both internal coordination and client interactions.
• Ability to work with cross-functional teams in a fast-paced BPO environment.

Key Responsibilities

1. Risk Management

• Conduct regular assessments of operational, financial, data security, and business continuity risks in BPO operations.
• Support the development and maintenance of the Enterprise Risk Management (ERM) framework.
• Perform process risk reviews, incident root-cause analysis, and control effectiveness testing.
• Manage risk registers and support the implementation of mitigation plans.
• Coordinate with operations teams to identify risks in workflows, SLAs, and new client implementations.

2. Compliance Oversight

• Ensure compliance with client-specific requirements, data privacy agreements, and industry regulations such as:
• Philippine Data Privacy Act (NPC)
• ISO 27001 / SOC 2 standards (if applicable)
• DOLE, SEC, BIR regulations
• Client-mandated compliance frameworks
• Conduct internal compliance checks, policy reviews, and operational audits.
• Review vendor risks and ensure third-party compliance.

3. Information Security & Data Privacy

• Work closely with the Information Security team to enforce security policies and procedures.
• Participate in data privacy impact assessments (DPIA) and breach incident investigations.
• Ensure compliance with data handling, access control, and confidentiality guidelines.

4. Governance & Reporting

• Prepare compliance and risk reports for leadership, clients, and external auditors.
• Assist in internal and external audit preparation, documentation, and corrective action tracking.
• Participate in client due diligence, compliance calls, and contract reviews.

5. Training & Culture Building

• Conduct compliance and risk training for employees, supervisors, and new hires.
• Support awareness programs on data privacy, information security, fraud prevention, and ethical conduct.
• Promote a culture of risk awareness and compliance across teams.