Responsibilities
Maintain VALR’s POPIA compliance framework and PAIA manual, and act as the contact point for the Information Regulator, other supervisory authorities and data subjects.
Inform and advise the business and staff on their POPIA and GDPR obligations, monitor compliance, and report on privacy risk and compliance status to executive leadership.
Oversee data subject requests, PAIA requests involving personal information and other privacy rights within statutory timeframes.
Govern cross-border transfers and disclosures of personal information to third parties.
Ensure KYC, CDD, enhanced due diligence, transaction monitoring and blockchain analytics data is collected, used, shared and retained lawfully under both AML and data protection laws.
Govern Travel Rule data exchanged with counterparty VASPs and reconcile AML record-keeping periods with data retention requirements.
Support the MLCO/MLRO on STR confidentiality and preventing tipping off.
Manage VALR’s DPIA and security risk assessment processes for products, systems, vendors and processing activities, maintain the risk registers and track remediation.
Escalate material privacy or security risks where controls are inadequate or remediation is outstanding.
Oversee Data Loss Prevention (DLP) controls, segregation of customer personal data between administrative and standard user environments and devices, and separation of privileged, administrative and standard access roles.
Manage the approval process for SaaS platforms, AI tools, browser applications, APIs and integrations, reviewing security safeguards, privacy terms, DPAs and sub-processors.
Assess AI processing, including whether VALR or personal information may be used for model training, and monitor approved applications for material changes in permissions, data access or risk.
Assess security incidents for impact on personal information and lead required notifications to the Information Regulator, other supervisory authorities and affected data subjects.
Maintain incident and breach records and track corrective actions.
Work with Engineering, Product, Risk and Security to embed privacy by design and by default (data minimisation, access restriction, retention and secure handling), including reviews of architecture, data flows, APIs, databases, cloud services and integrations.
Draft and maintain privacy and security policies, standards and procedures, and keep evidence of compliance.
Monitor changes in privacy, data protection, cybersecurity and AML law, guidance and standards, and assess their impact on VALR.
Deliver practical privacy and cybersecurity advice and training to staff and business teams.
Requirements
At least 8 years’ experience in data privacy and protection and anti-money laundering (AML) compliance, with substantial hands-on experience in both, preferably at a crypto asset service provider, fintech or financial institution.
A relevant diploma, degree or equivalent practical experience in Information Security, Law, Compliance or Risk.
A recognised privacy certification (e.g. CIPP/E, CIPM) and AML certification (e.g. CAMS, CCAS).
Strong knowledge of POPIA, PAIA and GDPR, including Information Regulator requirements and the role of Information Officers and Deputy Information Officers.
Strong knowledge of AML/CFT frameworks, including the FIC Act, FATF standards for virtual assets and VASPs, and the Travel Rule.
Working knowledge of cybersecurity principles, including authentication, MFA, IAM, encryption, access control, DLP, logging, cloud security and incident response.
A keen interest in Artificial Intelligence and its privacy and data governance implications.
Advantageous: experience across VALR’s jurisdictions – South Africa (FIC Act, FAIS; Information Regulator, FIC, FSCA), Africa (e.g. Kenya’s Data Protection Act and VASP Act), Europe (MiCA, EU AML framework) and the Caribbean (Cayman Islands Data Protection Act, AML Regulations and Virtual Asset (Service Providers) Act; CIMA).
Benefits
Engage with the latest blockchain technologies and tools in a rapidly evolving industry.
Work from anywhere with secure, stable internet connectivity, allowing you to create your ideal workspace.
Benefit from an annual professional development allowance alongside scheduled company training sessions to keep you at the forefront of the crypto industry.
Competitive salaries that align with industry standards.
When you contribute to our success, you’ll be rewarded with discretionary bonuses, recognising your impact on VALR’s growth.
Receive preferential Tier 5 trading fees on VALR, with no monthly trading volume required.
A commitment to fostering a diverse workforce with initiatives that promote equity and belonging.
Employees are encouraged to strive for coherent and wholesome lives, fulfilling their work, personal, social, physical and spiritual goals to the best of their abilities.
Compliance with statutory leave required by individual countries, in addition to flexible leave options.
Enjoy lunch on us when working from our Johannesburg Head Office, one of the ways we support wellbeing and connection in the workplace.
At VALR, we believe in a financial system that recognises the oneness of humanity. Our mission is to break down financial barriers and promote universal values of courage, ethical integrity, and the intrinsic worth of every individual.
Engage in initiatives that promote education and awareness about cryptocurrencies, ensuring that everyone has the tools and knowledge to participate in the evolving financial landscape.
Open communication and teamwork across departments, fostering innovation and creativity.
Enjoy social gatherings outside of work to strengthen team bonds and boost morale.
Work with colleagues from around the world.
Exposure to diverse perspectives and practices in the crypto space.
Regular acknowledgement of employee accomplishments, fostering a culture of appreciation and motivation.
Join us for retreats that blend professional development with team bonding in inspiring locations.
Receive a Mac laptop and a discretionary allowance to purchase all the extras needed for a productive home officeyours to keep after three years (terms and conditions apply).
Originally posted on Himalayas