Risk and Compliance Manager

Responsibilities

• Ensure UK/US regulatory and industry compliance.
• Monitor regulatory changes and advise on business impact.
• Develop and maintain policies covering bribery, fraud and compliance.
• Manage client audits, due diligence and compliance requests.
• Oversee ESG, including EcoVadis, carbon footprint and DEI.
• Review contracts and marketing for CMA/FCA greenwashing compliance.
• Own and maintain the enterprise risk management framework and risk register.
• Identify, assess and manage operational, regulatory, contractual and reputational risks.
• Track risk remediation and mitigation actions.
• Partner with IT on cyber and information security risk.
• Act as DPO, overseeing UK GDPR, DPA 2018, PECR and US privacy requirements (CCPA/CPRA).
• Review data processing agreements and contractual privacy requirements.
• Maintain privacy policies, notices and registrations.
• Assess cross-border data transfers.
• Lead responses to client information security questionnaires.
• Liaise with IT/MSPs on security and data classification.
• Develop and maintain AI governance policies and procedures.
• Assess AI tools against data protection and contractual requirements.

Requirements

• Strong experience across risk, compliance and governance.
• Good knowledge of UK GDPR / Data Protection Act 2018 / PECR and ideally US privacy regulations such as CCPA/CPRA.
• Experience developing or managing enterprise risk frameworks and risk registers.
• Exposure to information security, cyber risk and/or AI governance.
• Confidence working with contracts, policies, audits and client due diligence.
• Excellent stakeholder management and communication skills.
• A practical, commercially minded approach to compliance - you don't just identify the risk; you help the business manage it.