Manager Technology Risk & DLP

Job Summary

We are seeking an experienced Technology Risk and DLP professional to lead enterprise-wide Technology Risk, Data Loss Prevention (DLP), security governance and data protection initiatives. The role is responsible for identifying, assessing and managing technology risks across cloud, infrastructure, applications, networks, AI platforms and third-party ecosystems, while ensuring alignment with internal policies, regulatory requirements and customer contractual obligations. The role will act as a trusted risk advisor to business, technology, security, audit, legal, privacy, infrastructure, cloud and delivery teams. The incumbent will provide risk-based guidance for secure technology adoption, DLP governance, architecture decisions, audit remediation, policy compliance, AI Security and emerging technology initiatives.

Key Responsibilities

Technology Risk Governance

• Lead Technology Risk Management activities across enterprise IT, cloud platforms, applications, networks and security technologies.
• Perform and oversee technology risk assessments for new solutions, strategic initiatives, third-party platforms, SaaS services and material technology changes.
• Review and challenge technology proposals from security, compliance, architecture and operational risk perspectives.
• Maintain risk registers, define risk treatment plans and track risks through mitigation, acceptance or closure.
• Provide clear risk opinions, conditional approvals, remediation expectations and escalation recommendations to stakeholders and governance forums.

Data Protection and DLP Governance

• Own and continuously improve the enterprise DLP governance framework across endpoints, email, web, network, cloud, collaboration and AI usage channels.
• Define DLP policies, control requirements, exception processes, use cases, monitoring expectations and risk acceptance criteria.
• Provide governance and risk oversight for DLP technologies such as Microsoft Purview, Symantec DLP, Netskope CASB/DLP and associated integrations.
• Review DLP incidents, control gaps, policy tuning requirements and data exposure scenarios, and drive corrective actions with responsible teams.
• Assess handling of confidential, customer, regulated and personally identifiable information across platforms and business processes.

Security Architecture and Design Reviews

• Conduct and lead security architecture reviews for applications, infrastructure, cloud, network, API, AI and data integration designs.
• Evaluate designs against Zero Trust principles, least privilege, segregation of duties, secure connectivity and enterprise security standards.
• Assess identity and access management, encryption, key management, network segmentation, logging, monitoring, resilience and data-flow controls.
• Recommend secure design alternatives and compensating controls where standard requirements cannot be met.
• Ensure material security risks are documented and resolved before implementation or formally accepted by the appropriate authority.

AI Security and Emerging Technology Governance

• Assess risks associated with generative AI, copilots, AI agents, machine learning platforms, connectors, APIs and Model Context Protocol integrations.
• Evaluate AI use cases for data leakage, prompt injection, excessive permissions, unauthorized integrations, privacy impact and model or supply-chain risk.
• Contribute to AI security policies, guardrails, risk assessment methods and governance reviews.
• Provide control guidance for secure adoption of cloud-native, automation and other emerging technologies.

Audit, Assurance and Compliance

• Plan, coordinate and lead internal Technology Risk audits and support external, customer and regulatory assessments.
• Define audit scope, control objectives, evidence requirements, sampling expectations and stakeholder responsibilities.
• Review evidence for adequacy and validate the design and operating effectiveness of technology controls.
• Draft risk-based observations, agree remediation actions, monitor closure and verify sustainable remediation.

Policy, Standards and Exception Management

• Develop, review and maintain technology risk, cloud security, DLP, AI security, data protection and related governance requirements.
• Interpret internal policies and standards and provide practical implementation guidance to technology and delivery teams.
• Review security exceptions, deviations and risk acceptance requests for completeness, business justification, compensating controls and residual risk.
• Monitor approved exceptions through expiry, remediation or renewal and escalate overdue or unacceptable risks.

Third-Party and Vendor Security Risk

• Assess vendors, OEMs, SaaS providers, cloud services and technology partners before onboarding and during periodic reviews.
• Evaluate security certifications, independent assurance reports, privacy controls, data retention, access models, contractual safeguards and breach obligations.
• Identify supply-chain, integration and concentration risks and recommend appropriate contractual, technical and governance controls.

Risk Advisory and Incident Support

• Provide Technology Risk advisory support for security incidents, data exposure events, control failures and high-risk changes.
• Participate in root cause reviews and recommend preventive and detective control improvements.
• Provide risk inputs for client delivery, due diligence, pre-sales, platform onboarding and strategic transformation initiatives.

People Leadership and Stakeholder Management

• Manage, coach and mentor Technology Risk and DLP team members, including work allocation, quality review and capability development.
• Build effective relationships with CRO, CIO, CISO, Privacy, Legal, Internal Audit, Delivery, Infrastructure, Cloud and Architecture stakeholders.
• Prepare concise executive risk reports, dashboards, decision papers and governance updates.
• Drive risk awareness, documentation discipline, timely escalation and consistent application of enterprise security requirements.

Required Qualifications, Experience and Skills

Education

• Bachelor's degree in Engineering, Information Technology, Computer Science, Cyber Security or a related discipline.
• Master's degree in a relevant discipline is desirable.

Professional Experience

• Minimum 10 years of experience in information security, cyber security, Technology Risk, data protection, audit or governance roles.
• Demonstrated experience leading complex risk assessments, control reviews, DLP governance, security architecture reviews and audit remediation.
• Experience working with senior stakeholders and multidisciplinary teams in a large enterprise or regulated environment.
• Prior people-management, team-lead or workstream-lead experience.

Preferred Certifications

• CISSP, CISA, CRISC or CCSP preferred.
• Relevant Microsoft, AWS, Azure, cloud security or data protection certifications.