Director, Chief Privacy Officer

Company Introduction

Job Introduction

As a credit finance company, Coupang Financial's Privacy team checks compliance with laws and supervisory standards on the protection of personal information and personal credit information, and supports safe financial services growth based on customer trust. Based on the Personal Information Protection Act, the Act on the Use and Protection of Credit Information, the Electronic Financial Transactions Act and related financial regulations, the team establishes and operates policies and management systems, and carries out internal controls, third-party management, incident response and engagement with supervisory authorities.

In this role, as the Chief Privacy Officer (CPO) of Coupang Financial, the Chief Credit Information Administration and Protection Officer (CIAP) and the Director responsible for the Privacy organisation, you will lead the company-wide strategy and governance for the protection of personal and personal credit information. The candidate will report major privacy risks and improvement progress directly to management and the Board, and perform a core leadership role supporting business growth based on customer trust in a fast-changing financial regulatory environment.

Responsibilities

• You will lead the establishment, operation and advancement of company-wide strategy, medium- to long-term roadmaps, policies, rules and management systems for the protection of personal (credit) information and corporate credit information.
• You will perform the statutory duties of the Chief Privacy Officer (CPO) under the Personal Information Protection Act and the Chief Credit Information Administration and Protection Officer (CIAP) under the Credit Information Act.
• You will regularly examine the actual status and practices of personal (credit) information processing, and manage and supervise personal (credit) information processing systems and the lifecycle of personal (credit) information.
• You will lead internal control activities, risk assessments, ongoing assessments, self-inspections and the implementation of improvement measures relating to personal (credit) information, and report the results to management and relevant committees.
• You will operate the personal (credit) information risk management framework for outsourcees, sub-outsourcees and third-party recipients, including due diligence, contractual safeguards, periodic inspections, performance and incident management.
• You will lead the response to examinations, investigations, data requests and regulatory changes from relevant authorities, including the Financial Supervisory Service, the Personal Information Protection Commission and the Financial Services Commission.
• You will support certification and audit responses for ISMS-P, ISO 27001, PCI DSS and other relevant standards, and ensure consistency of controls with the information security and compliance organisations.
• You will establish and deliver personal (credit) information protection training and awareness programmes for employees and management, develop the Privacy team, and raise the expertise and execution capability of the organisation.
• You will establish personal (credit) information protection performance indicators and key risk indicators, immediately remedy significant issues and violations of law, and report directly to the CEO and the Board where necessary.

Requirements

• More than 15 years of experience in personal information protection, personal credit information protection, information protection or IT security governance, with company-wide leadership experience as head or equivalent in financial institutions, fintech firms, credit information companies, or personal credit management companies
• Meets the statutory CPO qualification requirements for personal information protection and can provide evidence of experience
• No disqualifying factors under the Act on the Governance of Financial Companies and related executive eligibility requirements, and able to pass the company's suitability review and experience verification procedures
• Strong understanding of, and practical application experience with, the Personal Information Protection Act, the Credit Information Act, the Electronic Financial Transactions Act, the Specialised Credit Finance Business Act and internal control environments of financial institutions
• Experience responding to regulatory examinations and investigations on personal and personal credit information, internal control, incident response, and reporting to management and the Board
• Experience collaborating with large-scale data processing environments and product and technology organisations to implement data governance and third-party management
• Communication skills to explain complex legal, technology and business risks clearly and to persuade management and diverse stakeholders

Preferred Qualifications

• Experience serving as Chief Privacy Officer (CPO), Chief Credit Information Administration and Protection Officer (CIAP) or an equivalent statutory officer role
• Experience protecting personal and personal credit information in specialised credit finance companies, credit card, lending, deferred payment, electronic finance or large-scale commerce environments
• Experience operating the collection, use, provision and protection framework for credit information of sole proprietors and corporations
• Experience in ISMS-P, ISO 27001 or PIA assessments and certifications, or relevant qualifications such as CIPP, CIPM, CISSP, CISA or ISMS-P certified auditor
• Experience establishing and operating compliance frameworks for information protection and electronic finance regulations in the financial sector, such as the Electronic Financial Supervision Regulation, or responding to inspections and examinations
• Experience managing privacy risks related to cloud, data analytics, AI and machine learning, and mobile services
• Experience coordinating complex issues across supervisory authorities, audit functions, legal and compliance, information protection, and engineering organisations, and completing improvements

Selection Process and Information

• Selection process
  • Document screening - job fit interview - core competency interview - final decision
  • The selection process may differ by role and may change depending on schedule and circumstances.
  • Selection schedules and results will be communicated individually to the email address registered on your application.
• Notes
  • The employment type is permanent, including a 12-week probationary period. However, where required for business reasons, the above probationary period may be waived, shortened or extended.
  • This advertisement may close early once recruitment is complete.
  • If the application contains false information, the offer may be cancelled.
  • Employment-protected candidates (veterans, persons with disabilities, etc.) may receive preferential treatment in accordance with relevant laws.
  • Job grade and scope of responsibilities may change depending on the candidate's overall career and experience. If such a change is necessary, the candidate will be contacted at an appropriate time before the final offer notification.
  • Recruitment may be restricted if the legally required qualifications for recruitment and job performance are not met.

Privacy Policy 

• The Coupang Group collects and processes your personal information in accordance with its Privacy Policy for Job Applicants (link below). https://www.coupang.jobs/kr/privacy-policy/

Document Return Policy 

1. This notice is given pursuant to Article 11(6) of the Act on Fair Hiring Procedures.
2. Applicants who do not pass the final selection may request the return of the recruitment documents they submitted, in accordance with the Act on Fair Hiring Procedures. However, this does not apply to documents submitted via the website or by email, or documents voluntarily submitted without our request. Where documents are lost due to natural disasters or other causes not attributable to the company, they are deemed returned.
3. Applicants requesting a return under paragraph 2 above should complete the document return request form [Form No. 3 of the Enforcement Rules of the Act on Fair Hiring Procedures] and submit it by email ([contact details removed]). Once submission is confirmed, the documents will be sent by registered post to the designated address within 14 days. In this case, the registered postage is payable by the recipient, so please note this. 
4. To prepare for return requests under paragraph 2 above, the company will keep the original recruitment documents submitted by applicants for 180 days from the date the hiring decision is confirmed. If no return is requested by then, the documents will be destroyed without delay in accordance with the Personal Information Protection Act.
5. However, paragraphs 1 to 4 above apply only where the labour laws of the Republic of Korea apply. Otherwise, they do not apply.