Information Security, Compliance & Data Protection Manager

What you’ll bring

Required

• 5+ years of combined IT and information security/GRC experience, ideally in an environment that handles sensitive client data — such as regulated industries, professional services, defence, government, or pharma.
• Strong, practical knowledge of GDPR and UK GDPR and day-to-day data protection, with experience navigating cross-border data transfer complexities. Bonus if you’ve been through a GDPR audit or worked for a multinational with operations both inside and outside the EU.
• Hands-on experience with ISO 27001 and/or SOC 2 implementation and audits.
• Core IT administration abilities — comfortable providing hands-on technical support alongside governance and strategy work.
• Working familiarity with the Microsoft 365 security stack (Entra ID, Defender, Purview, Intune).
• Experience responding to client/customer security assessments and questionnaires.
• AI fluency and day-to-day use of automation tools in your workflow — we’re an AI-forward firm and expect the same mindset from this role.
• Based in the UK with the right to work, ideally in or near London (the role is hybrid, occasional office presence is required).
• Excellent written and verbal communication: you can translate security and risk into plain business language for leadership, clients, and colleagues.

Strongly preferred

• Experience standing up or maturing a security/compliance programme (not only operating an established one).
• Experience serving as or supporting a Data Protection Officer (DPO) function.
• Familiarity with EU and UK regulatory developments such as NIS2 and DORA.
• Experience managing third-party/vendor risk for SaaS and AI tooling.

Nice to have

• Exposure to life sciences or pharma, and awareness of GxP, GDP, or healthcare data considerations (e.g., HIPAA for US-facing work).
• Experience establishing data-protection or data-risk practices.
• Experience supporting M&A or subsidiary integration from a security and compliance perspective.
• Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer/Auditor, CIPP/E, or CIPM — valued but not required; we prioritise practical experience.