Head of Data Protection

Job Title: Head of Data Protection
Reporting Line: Information Security Lead

Role location: London or Ipswich

The Role

Willis Re is a technology‑led reinsurance broker built on a cloud‑native, modular and data‑driven platform. As Head of Data Protection, you will own the strategy, controls and assurance that keep client and market data secure, compliant and resilient across all regions. Sitting within the Cyber function, you will embed privacy and security by design into our products, platforms and processes, enabling rapid, compliant growth and seamless global operations.

You will translate regulatory and client obligations into practical, scalable solutions that protect sensitive data end‑to‑end—at rest, in transit and in use—while supporting business agility. Operating in a hybrid delivery model, you will set standards, define accountability and measure outcomes for data confidentiality, integrity and availability, partnering closely with engineering, product, legal, risk and regional leaders.

Key responsibilities

• Define and own the enterprise data protection strategy, policies and standards, aligning to global frameworks while accommodating regional regulatory requirements.
• Implement privacy and security by design across the data lifecycle, including collection, minimisation, lawful basis, consent, retention, deletion and safe disposal.
• Establish technical controls for sensitive data, including encryption and key management, tokenisation/masking, data loss prevention, secure data sharing and segregation of duties.
• Set and enforce access control models (least privilege, role‑based and attribute‑based access), including joiner‑mover‑leaver processes and privileged access management.
• Deploy data discovery and classification at scale, maintaining accurate inventories of personal, client‑confidential and regulated data across cloud and SaaS estates.
• Lead breach readiness and response for data incidents in coordination with Cyber, Legal and Communications, including playbooks, tabletop exercises, notification and lessons learned.
• Provide security assurance across change initiatives to ensure new platforms and data products meet data protection requirements from design through deployment.
• Oversee cross‑border data transfer governance, residency controls and supplier data protection due diligence, including contractual clauses and ongoing assurance.
• Drive regulatory readiness and evidence for audits and client due diligence, maintaining clear metrics and reporting on control effectiveness and risk posture.
• Manage a hybrid delivery model for data protection capabilities and tooling, directing in‑house teams and partners with clear KPIs, cost transparency and value realisation.

About you

You are a business‑minded data protection leader who converts regulatory and client obligations into simple, scalable guardrails that enable the business to move fast without compromising control. You balance strategic design with hands‑on depth, bringing clarity to complex privacy and security topics and ensuring decisions are grounded in risk and value.

You thrive in a start‑up environment and are comfortable operating beyond your usual remit to get things done—rolling up your sleeves to build policies, processes and capabilities from the ground up. You communicate crisply with executives, engineers and external stakeholders, make trade‑offs explicit and take clear ownership for outcomes across a global footprint.

Skills and experience

• Significant experience leading data protection or privacy programmes in complex, cloud‑first environments; insurance/reinsurance or financial services experience strongly preferred.
• Deep knowledge of data protection and privacy regulations and principles (e.g., GDPR, UK GDPR, CCPA/CPRA and relevant sectoral obligations), and how to operationalise them at scale.
• Strong command of technical and organisational controls: encryption and key management, tokenisation/masking, DLP, IAM/PAM, secure configuration, data minimisation and logging/monitoring.
• Proven track record implementing privacy/security by design, data lifecycle and retention management, subject rights processes and incident/breach response.
• Hands‑on experience with data discovery, classification and cataloguing tools across multi‑cloud and SaaS estates, and integration into engineering workflows.
• Experience governing cross‑border data transfers, residency controls and third‑party data protection, including contractual mechanisms and continuous assurance.
• Demonstrated ability to deliver audit readiness and client assurance, with clear metrics, KPIs and board‑level reporting on control effectiveness and risk reduction.
• Strong stakeholder management and influencing skills across Cyber, Legal, Risk, product and regional teams in a multi‑jurisdictional environment.

Compensation and Benefits: Base salary range and benefits information for this position are being included in accordance with requirements of various state/local pay transparency legislation. Please note that base salaries may vary for different individuals in the same role based on several factors, including but not limited to location of the role, individual competencies, education/professional certifications, qualifications/experience, performance in the role and potential for revenue generation (Producer roles only).

#LI-SS1

About Willis Re

We combine specialist broking with analytics, modeling and research to help insurers optimize risk transfer, strengthen balance sheets and achieve sustainable growth. Our approach is relationship-driven, transparent and outcome-focused.

At the heart of Willis Re is a focus on delivering the most cutting-edge analytical solutions to enable more informed, better decision-making for risk selection, portfolio optimization, and capital management.

The launch of Willis Re brings a strategic advantage of being unhindered by legacy, an ability to leverage data, statistical models and advanced technologies with the best knowledge and expertise to deliver more efficient and effective reinsurance outcomes. This places Willis Re in a unique position to build a truly analytically driven business, focused on creating solutions for the reinsurance industry that are future led and forward thinking.

Willis Re will also leverage recognized technical expertise from WTW’s Insurance Consulting & Technology business including their advanced modeling and analytical capabilities. Alongside this will be WTW’s Research Network, an award-winning business supporting and influencing science to improve the understanding and quantification of risk.

About Willis Re

We combine specialist broking with analytics, modeling and research to help insurers optimize risk transfer, strengthen balance sheets and achieve sustainable growth. Our approach is relationship-driven, transparent and outcome-focused.

At the heart of Willis Re is a focus on delivering the most cutting-edge analytical solutions to enable more informed, better decision-making for risk selection, portfolio optimization, and capital management.

The launch of Willis Re brings a strategic advantage of being unhindered by legacy, an ability to leverage data, statistical models and advanced technologies with the best knowledge and expertise to deliver more efficient and effective reinsurance outcomes. This places Willis Re in a unique position to build a truly analytically driven business, focused on creating solutions for the reinsurance industry that are future led and forward thinking.

Willis Re will also leverage recognized technical expertise from WTW’s Insurance Consulting & Technology business including their advanced modeling and analytical capabilities. Alongside this will be WTW’s Research Network, an award-winning business supporting and influencing science to improve the understanding and quantification of risk.