Data Protection Manager, Inspired Thinking Group (ITG), GB

We are looking for an enthusiastic and detail-oriented Data Protection Manager to join our growing information security and data protection team. This is an ideal opportunity for someone with existing data protection knowledge and experience to further their career in information security and data protection.

The Role:

The Data Protection Manager will be responsible for driving the technical implementation of data protection practices across our systems and infrastructure. You will work collaboratively with the wider Information Security team to deliver a consistent and easily understood approach. Reporting to the Director of Information Security and Data Protection Officer, you will play a hands-on role in ensuring that our platforms, applications, and third-party services are aligned with data protection policies, regulatory requirements, and information security best practices. The ideal candidate is eager to learn and grow within the data protection and information security fields while contributing to the team’s efforts to protect our organisation's data and IT infrastructure.

This role focusses on the operational aspects of data protection — from technical risk assessments and secure system configuration reviews to incident response, vulnerability remediation tracking, and regulatory compliance audits. You will work closely with engineering, DevOps, and IT teams to embed privacy and information security controls into our technology stack.

This is a full-time position. Occasional after-hours work may be required to support incident response, high-priority vulnerability fixes, or audit activities. 

Develop and implement data protection governance: 

• Design, implement, and enforce data protection and information security policies and procedures aligned with business objectives and regulatory requirements 

• Support the development of strategies to mitigate and monitor data protection risks and incidents 

• Coordinate internal audits, assessments, and recommend improvements to enhance data protection posture 

• Work collaboratively with the wider Information Security team to identify and develop a strategy to mitigate, manage, and monitor data protection risks and incidents 

• Work collaboratively with other departments to ensure the alignment of security efforts with wider business objectives 

Risk management: 

• Identify, assess, and document data protection risks across systems and processes 

• Support administration of data protection systems and risk reporting. 

• Provide advice and guidance to teams on how to mitigate any identified risks 

Vulnerability management:

• Coordinate data protection assurance testing and vulnerability management  

• Provide advice and guidance to teams on how to mitigate vulnerabilities, and following up on remediation progress 

• Collaborate with development teams to integrate secure coding and privacy-by-design principles 

Incident response & recovery: 

• Lead incident response efforts on a duty basis 

• Provide guidance on threat mitigation, containment, and recovery processes 

Legal and regulatory conformance: 

• Ensure conformance with relevant regulations (CCPA, GDPR, etc.) 

• Manage ITG group data protection process, including all relevant external audits, internal assessments, and planning 

• Ensure the accurate review of system configurations takes place to ensure alignment with data protection and information security best practices  

• Ensure the documenting of configuration settings 

Staff training & awareness:  

• Implement and manage an enterprise-wide data protection awareness training program 

• Conduct regular training sessions and awareness programs to educate employees on data protection risks and best practices  

Vendor management:  

• Manage third-party vendor data protection assessments, ensuring third-party partners comply with data protection standards 

Reporting & documentation:  

• Maintain accurate records of data protection and information security incidents, audits, assessments etc. and compile progress reports 

• Implement and report on data protection and information security key performance indicators and outcome driven metrics 

Continuous improvement:  

• Continuously assess our data protection and information security position and recommend improvements to strengthen data protection and information security 

• Keep up to date with the latest data protection and information security threats, trends, technologies, and regulations in the industry 

• Keep the organisation updated on industry best practices