Data Protection Officer

Fynd is India's largest omnichannel platform and multi-platform tech company with expertise in retail tech and products in AI, ML, big data ops, gaming+crypto, image editing and learning space. Founded in 2012 by 3 IIT Bombay alumni: Farooq Adam, Harsh Shah and Sreeraman MG. We are headquartered in Mumbai and have 1000+ brands under management, more than 10k stores and servicing 23k + pin codes.

We are seeking a highly skilled Data Protection Officer (DPO) / GRC Officer responsible for ensuring compliance with global security and data protection regulations. The ideal candidate will oversee governance, risk, and compliance (GRC) programs, implement security frameworks, and safeguard sensitive data across the organization.

What will you do at Fynd ?

1. Governance, Risk, and Compliance (GRC):

2. Develop, implement, and maintain GRC frameworks to align with regulatory and industry standards.

3. Establish risk assessment methodologies and ensure mitigation strategies are in place.
4. Conduct IT General Controls (ITGC) assessments to ensure effective security controls and processes.

5. Oversee third-party risk assessments, ensuring vendors comply with security policies.

6. Data Protection & Privacy Compliance:

7. Implement and oversee compliance with DPDP (Digital Personal Data Protection Act, India) and GDPR regulations.

8. Act as the point of contact for data protection authorities and internal privacy matters.
9. Conduct Data Protection Impact Assessments (DPIAs) and privacy risk assessments.

10. Develop and enforce privacy policies, data retention, and protection measures.

11. Information Security Compliance & Certifications:

12. Lead and maintain compliance with ISO 27001, ensuring policies and controls meet certification requirements.

13. Manage SOC 2 compliance efforts, including security, availability, processing integrity, confidentiality, and privacy principles.
14. Oversee PCI-DSS compliance for handling cardholder data securely.

15. Ensure alignment with NIST security frameworks for risk management and cybersecurity resilience.

16. Business Continuity & Incident Management:

17. Develop and maintain a Business Continuity Management (BCM) program, including disaster recovery plans.

18. Lead security incident response and investigations to mitigate data breaches and cybersecurity threats.
19. Conduct regular tabletop exercises and audits to test resilience and readiness.

Some Specific Requirements

• Bachelor's/Master's degree in Information Security, Cybersecurity, Compliance, or a related field.
• Professional certifications such as CIPP/E, CIPM, CISSP, CISM, CISA, ISO 27001 Lead Auditor, or CRISC are highly preferred.
• 5+ years of experience in Data Protection, Compliance, GRC, or Cybersecurity roles.
• Strong knowledge of regulatory frameworks (SOC2, ISO27001, GDPR, DPDP, PCI-DSS, NIST, ITGC, Third-Party Risk Management).
• Experience in implementing GRC tools and automating compliance processes.
• Excellent stakeholder management skills with the ability to work cross-functionally.
• Strong analytical, problem-solving, and decision-making skills.

What do we offer?

Growth

Growth knows no bounds, as we foster an environment that encourages creativity, embraces challenges, and cultivates a culture of continuous expansion. We are looking at new product lines, international markets and brilliant people to grow even further. We teach, groom and nurture our people to become leaders. You get to grow with a company that is growing exponentially.

Flex University

We help you upskill by organising in-house courses on important subjects

Learning Wallet: You can also do an external course to upskill and grow, we reimburse it for you.

Culture

Community and Team building activities

Host weekly, quarterly and annual events/parties.

Wellness

Mediclaim policy for you + parents + spouse + kids

Experienced therapist for better mental health, improve productivity & work-life balance

We work from the office 5 days a week to promote collaboration and teamwork. Join us to make an impact in an engaging, in-person environment