Compliance Risk Management Officer

**Responsibilities**:

- Participating in the design, development, delivery and maintenance of best-in-class Compliance programs, policies and practices for ICRM.
- Analyzing complex comparative data, preparing and presenting regional and global reports related to compliance risk assessments, and monitoring of compliance related issues.
- Reviewing materials to ensure compliance with various regulatory and legal requirements and to ensure compliance risks are appropriately identified and addressed.
- Investigating and responding to compliance risk issues. Investigating regulatory inquiries, preparing required documentation, making recommendations to senior management on how to proceed, and preparing responses for the regulatory inquiries.
- Overseeing the monitoring of adherence to Citi’s Compliance Risk Policies and relevant procedures and preparation, editing, and maintenance of Compliance program related materials.
- Interacting and working with other areas within Citi, as necessary.
- Keeping abreast of regulatory changes, new regulations and internal policy changes in order to further identify new key risk areas.
- Additional duties as assigned, including:

- Acting as the South Africa Data Protection Officer with responsibility for advising and monitoring data protection requirements, and escalating matters as appropriate to the EMEA Chief Privacy Officer, the South Africa Franchise Governance Head, the South Africa Compliance Officer and relevant governance forum in line with local regulatory requirements;
- Helping to facilitate compliance with and advising on local data protection, privacy and banking confidentiality laws to Citi branches and subsidiaries across South Africa and promoting good privacy practices;
- Assisting with the design and delivery of the global and local privacy program, including policies, standards and procedures, tools, monitoring, metrics and reporting and sharing leading practices with other DPOs and business stakeholders;
- Acting as a point of contact between Citi Legal Entities in South Africa and the local privacy regulators on matters relating to privacy;
- Reviewing and advising on South Africa data protection impact assessments on potential risks and mitigating controls, where necessary; developing an understanding of local data processing activities and associated privacy risks.
- Advising on privacy-related considerations and requirements during the investigation of security incidents including advising on notifications to local privacy regulators;
- Working with the Regional Chief Privacy Officer to advise on the implementation of new data protection, privacy and banking confidentiality laws in Citi Legal Entities across South Africa, working closely with first line In-Business Privacy Officers, local Product and Function teams and Country Legal and Compliance;
- Attending industry body meetings to discuss and provide input to regulatory changes relating to data privacy laws;
- Engaging the key privacy regulators in relating on any privacy matter under the South African legislation.

**Qualifications**:
**Required**:

- Knowledge of Compliance laws, rules, regulations, risks and typologies, specifically privacy and data protection laws, rules and regulations in South Africa
- Must be a self-starter, flexible, innovative and adaptive
- Strong interpersonal skills with the ability to work collaboratively and with people at all levels of the organization
- Strong written and verbal communication and interpersonal skills
- Ability to both work collaboratively and independently; ability to navigate a complex organization
- Advanced analytical skills
- Ability to both work independently and collaborate with team members
- Excellent project management and organizational skills and capability to handle multiple projects at one time
- Ability to raise awareness on data protection and privacy requirements within the organization
- Written and spoken English language skills (professional proficiency)

**Preferred**:

- Knowledge and experience in understanding personal data processing activities and managing areas relevant to privacy and data protection (e.g. information security; data governance; third party risk management)
- Knowledge of IT systems in financial services organizations
- Understanding of data security and information technology

**Education**:
**Required**:Bachelor’s degree; experience in compliance, legal or other control-related function in the financial services firm, regulatory organization, or legal/consulting firm, or a combination thereof; knowledge of the local privacy laws and regulations in South Africa; experience in advising on and implementing practical solutions for privacy/compliance issues.

**Preferred**: Advanced degree (e.g. JD, MBA) a plus

IAPP CIPP, CIPM, CIPT or other Data Protection Officer certification (existing or pending) is an advantage

CISSP and CIPM and other Information Security-related certifications are a plus
- **Jo