Data Protection Officer - Internal Audit

Al Khayyat Investments is looking for a Data Protection Officer to lead data protection and privacy activities across the Group.This role is suitable for a technically strong professional with experience in IT audit, information security, technology compliance, data protection, and privacy governance.Key ResponsibilitiesLead data protection and privacy activities across group operations and support functions.Ensure alignment with data protection policies, data classification standards, and applicable regulations.Support data governance activities, including data classification, labelling, and Records of Processing Activities.Conduct risk assessments, DPIAs, transfer impact assessments, and maintain the privacy risk register.Perform audits covering IT General Controls, information security, cyber security, data processing activities, systems, vendors, and third parties.Review vendor arrangements, data processing agreements, and privacy due diligence requirements.Support personal data breach response, including investigation, impact assessment, and regulatory notification.Deliver data protection awareness and training across the organisation.Work closely with Internal Audit, IT, and business teams to assess controls across ERP, CRM, HR, e-commerce, SaaS platforms, and emerging technologies.RequirementsBachelor’s degree in Information Technology, Computer Science, Information Security, or a related field.2–3 years of experience in IT internal audit, information security audit, technology compliance, or consulting.Hands-on audit experience is essential.Knowledge of ISO 27001, COBIT, NIST CSF, UAE PDPL, ADHICS, KSA PDPL/SDAIA, Oman PDPL, GDPR, ISO/IEC 27701, or NIST Privacy Framework.Experience with enterprise systems such as SAP, Oracle, Microsoft Dynamics, cloud platforms, or SaaS applications.Strong report-writing, communication, and stakeholder management skills.PreferredCIA, CISA, ISO 27701 Lead Implementer/Auditor, or equivalent certification.Experience in a large, diversified, or multi-entity organisation.Familiarity with GRC platforms and AI governance concepts.