Owns Athena’s organization-wide data governance, privacy, protection, and responsible AI framework across multiple countries. The role develops policies, consent and risk tools, data inventories, compliance processes, incident response, AI approvals, and ISO 27001/SOC 2 readiness. It also trains staff and partners, supports live projects, manages audits, advises clients and regulators, and reports governance progress to leadership.
Position: Manager – Data Governance and Responsible AI
Location: India- Chennai, New Delhi or Bengaluru. Hybrid, with travel to Athena offices, project sites and field partners in India and occasionally abroad
Position Type: Full Time
Experience: 8–12 years
About Athena
Athena Infonomics is a research, advisory and implementation firm working with governments, multilateral institutions, foundations and companies on development and public-policy problems. We operate across India, the United States, EU, Asia and Africa. The group also includes TolaData, an impact-measurement software platform, and early-stage work in AI and digital public infrastructure.
Our work runs on data that is often personal, sensitive or confidential: household and beneficiary surveys, qualitative interviews with vulnerable groups, health and social-protection records, government administrative datasets, and proprietary client data. Much of it is collected in the field by our staff, enumerators and partners, then stored, analysed, shared and archived across several countries and tools. Our teams also use AI every day, on that same data.
Two things make this role necessary now. India's Digital Personal Data Protection Act and its Rules take effect in stages through 2026 and 2027, alongside GDPR and other regimes we already work under. And our use of AI has grown faster than the guardrails around it. We want one organisation-wide way of governing, protecting and using data that is practical for field teams and credible to clients, regulators and investors. This role builds and owns it.
The role
You will own how the Athena group governs, protects and uses data, including how it uses AI on client and participant data. You will design the framework, write the policies and tools, put them into daily use across practices and offices, and keep them current as law, clients and technology change. You will be the person clients, auditors and regulators talk to about our data practices, and the person our project teams call when a hard case comes up in the field.
This is a build-and-own role, not a compliance desk. You start with an independent diagnostic of where we stand; your job is to turn its findings into a working system and then run it. The measure of success is that a project manager in Chennai, a field coordinator in Nairobi and a product engineer at TolaData each know what they may do with data, do it without asking, and can show it if asked.
What you will do
1. Build and own the data governance framework
• Take the findings of the independent diagnostic and turn them into a right-sized policy suite: data governance, data protection and privacy, information security, classification and handling, retention and disposal, third-party and field-partner data, breach and incident response, data sharing and publication.
• Set the governance model: who owns which data, who decides, and how the policies are kept current. Run the Data Governance Steering Group's cadence.
• Build the operating toolkit teams actually use: project data management plans (with a light version for low-risk work), consent frameworks for written, verbal, digital and low-literacy settings, DPIA and screening checklists, data sharing and processing agreement templates, field data protocols, project start-up and close-out checklists.
• Maintain the data inventory and record of processing activities across entities.
2. Make the group compliant and keep it there
• Own readiness for India's DPDP Act and Rules across their phased deadlines, and for GDPR, UK GDPR, Kenya's Data Protection Act and client-specific requirements in the countries where we work.
• Act as, or stand up, the Data Protection Officer function; be the named contact for clients, data principals and regulators.
• Review data clauses in client contracts, sub-contracts and vendor agreements, working with external counsel where needed.
• Run breach and incident response when it is needed, and the drills before it is.
• Prepare TolaData for the certifications its customers and investors will expect (ISO 27001 and SOC 2 readiness), working with the product and engineering team and specialist consultants.
3. Govern how we use AI
• Build and maintain the AI tool register and approval process: which tools, which data classes, under what vendor terms, with what human oversight.
• Write and keep current the Responsible AI policy, covering staff use of generative AI on client and participant data and the AI features in products we build for clients and in TolaData.
• Design AI risk assessment into the project lifecycle so teams can use AI productively with clear guardrails rather than being blocked by default.
• Stay close to how our teams and products actually use AI, and keep the rules practical as the tools change.
4. Put it into daily practice
• Train leaders, project managers, data analysts, field coordinators and partner enumerators, using our own cases; build the short modules new staff and partners go through before they handle data.
• Work alongside project teams on live engagements: review data management plans, sit in on field design, resolve hard cases quickly.
• Run a light audit cycle: sample projects each year, trace data from collection to disposal, publish what was found and what changed.
• Track a small set of indicators the Co-Founders review each quarter, and report to clients and auditors when asked.
How the role works
• Scope. You are employed by Athena Infonomics, but the mandate spans the group. Expect a substantial share of your time on TolaData, which processes client monitoring data as a software platform and is preparing for institutional investment, and some on the group's AI ventures and its US federal work.
• Reporting. You report to the Co-Founder and a small Data Governance Steering Group that meets monthly. Practice heads, IT, the TolaData product lead and legal counsel sit on it. You set its agenda.
• Independence. You are expected to say no, in writing, when a project, product or client request cannot be done safely, and to propose what can. The Co-Founders will back that.
• Proportionate by design. Controls must match the sensitivity of the data and the risk. Low-risk work stays light. A framework field teams cannot follow in a low-connectivity, multi-language setting is a failed framework.
• Specialists on call. You will have a budget for external counsel, penetration testing and certification consultants. You decide when to use them; you do not need to be a lawyer or a security engineer yourself.
• Time zones and travel. The group works across India, East Africa, Europe and the United States. Some early-morning or evening calls are part of the job, as is travel to Athena offices, project sites and field partners.
• Discretion. You will see client data, contracts, incident reports and investor material from day one. Judgement about what to share, with whom, and when is a core requirement.
• Tools. We use AI tools every day for research, drafting and analysis. You should already work this way, and be able to govern it from the inside.
Who we are looking for
Must have
• 8–12 years of experience, with a substantial part spent building or running a data protection, privacy or data governance programme inside an organisation or for clients. You have implemented, not only advised.
• Working command of India's DPDP Act and Rules and of GDPR, and the ability to read a new regime or a client's data requirements and turn them into practice.
• Experience writing policies, procedures and templates that people actually used, and training people to use them.
• Enough information security literacy to run an ISO 27001 or SOC 2 readiness effort and to manage a security consultant well. You do not need to be the engineer.
• Practical understanding of how generative AI tools handle data (training, retention, hosting, account types) and of what responsible use looks like in an organisation.
• Excellent written English. Policies, guidance and client responses that a non-specialist can follow and a specialist cannot fault.
• Judgement and steadiness: comfortable taking a firm position with senior colleagues and clients, and finding the workable answer rather than the safest-sounding one.
• Fluent daily use of AI tools in your own work.
Strongly preferred
• A recognised privacy or AI governance credential: CIPP/E, CIPM, DSCI DCPP or DCPLA, AIGP.
• Experience with research or development-sector data: informed consent, field data collection, enumerator partners, ethics review, vulnerable participants.
• Exposure to a software or SaaS business, including vendor security questionnaires, data processing agreements and certification audits.
• Experience working across several countries and legal regimes, including Kenya or other East African markets.
• Experience with donor and client data requirements from multilateral institutions, foundations and government clients.
What success looks like
What this role is not
• Not an IT or security engineering role. You will set requirements and check they are met; IT and TolaData engineering will implement them.
• Not a legal counsel role. You will work with external counsel on contracts and regulatory questions; you will not be the firm's lawyer.
• Not a policy-writing exercise that ends at publication. The job is the practice, not the documents.
• Not a gatekeeper. The brief is to let the group use data and AI more, more safely, not less.
Where this leads
This is designed as a two- to three-year build. People who succeed in it grow into a group-wide risk and compliance leadership role, a senior operating role at TolaData as it scales, or a client-facing practice advising governments and development organisations on data governance and responsible AI, an area where Athena already works and intends to do more. You will leave knowing how a multi-country research, software and AI business handles sensitive data, from the village to the investor data room.
Athena’s Work Culture
At Athena, we function in an outcomes-based work environment with flexible hours and a high level of autonomy. Professional development and thought leadership are key elements of our business model: we support our team members' professional growth through on-the-job training, and we encourage the cultivation of our colleagues’ personal brands through participation in panels, events, publications, and other thought-leadership opportunities. We embrace a transparent, open work environment with meaningful leadership pathways for those with inventive ideas and initiatives.
Athena Infonomics is an Equal Opportunities Employer
Athena Infonomics is an equal opportunity employer with a commitment to diversity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.
AI Proficiency and Responsible Use
Proficiency in the responsible and sophisticated use of AI is a mandatory requirement for all roles, across all levels and functions at Athena Infonomics
Athena Infonomics Chennai, Tamil Nadu, IND Office
Chennai, India
Similar Jobs
Aerospace • Artificial Intelligence • Cloud • Machine Learning • Software • Cybersecurity • Defense
Provides technical leadership for aerospace navigation database production and customer support. Engages internal and external stakeholders to resolve technical issues, delivers tailored solutions, and supports production lifecycle activities. Develops quality assurance processes aligned with DO-200 standards, conducts reviews and audits, coordinates with source suppliers, improves workflows, and mentors team members. Requires extensive aerospace and flight operations knowledge, including FMS, ARINC 424, navigation procedures, flight planning, and aeronautical charts.
Top Skills:
Aerospace Navigation DatabasesArinc 424Do-200Flight Management Systems (Fms)Honeywell Navigation Database Formats
Aerospace • Artificial Intelligence • Cloud • Machine Learning • Software • Cybersecurity • Defense
Designs, develops, integrates, and validates aerospace engine, power, avionics, and actuation control systems. Responsibilities include requirements engineering, system architecture, control-system analysis, MATLAB/Simulink modeling, embedded C development, sensor and actuator integration, SIL/HIL testing, verification, validation, and aerospace certification compliance. The role supports model-based development and real-time embedded applications using aerospace standards and communication protocols.
Top Skills:
AfdxArinc 429Arm CortexArp4754AArp4761C++CanDo-160Do-178CDo-254DoorsDoors NgEmbedded CHilMatlabMbsePowerpcRs232Rs422/485RtosSilSimulinkStateflowSysmlTi C2000
Aerospace • Artificial Intelligence • Cloud • Machine Learning • Software • Cybersecurity • Defense
Manages export compliance operations, including transaction screening, audits, risk assessments, export licenses, metrics, regulatory procedures, training, and internal controls. Ensures global trade activities comply with restricted-party, embargo, EAR, ITAR, OFAC, BIS, SCOMET, and Military End User requirements. Develops policies, coordinates license renewals, supports compliance systems access, and communicates procedural updates across the organization.
Top Skills:
BisEarItarMilitary End User RegulationsOcr EaseOfacSap GtsScomet
What you need to know about the Chennai Tech Scene
To locals, it's no secret that South India is leading the charge in big data infrastructure. While the environmental impact of data centers has long been a concern, emerging hubs like Chennai are favored by companies seeking ready access to renewable energy resources, which provide more sustainable and cost-effective solutions. As a result, Chennai, along with neighboring Bengaluru and Hyderabad, is poised for significant growth, with a projected 65 percent increase in data center capacity over the next decade.
