About the Role

You’ll take ownership of our certification and audit programmes, including ISO 27001 and PCI DSS, our approach to multi-jurisdictional regulatory compliance, information governance, and our security and information policy framework. You’ll be our designated point of accountability for reporting information security and compliance posture to the ELT and Board.

Working closely with our technical leaders, you’ll bring together the regulatory, risk and security picture across the business, translating complexity into clear priorities, practical frameworks and confident decision-making.

This is a genuine opportunity to build and shape how Compass approaches risk, compliance and information security, creating a framework that supports the business while keeping pace with its evolving technology, regulatory and commercial environment.

What you'll own

• Certifications and standards: maintain the ISMS, and manage certification audits and corrective actions for ISO 27001 and equivalent standards.
• Payment security compliance: scope and maintain PCI DSS compliance for any payment processing.
• Privacy and data protection: obligations under the Australian Privacy Principles and equivalent UK and Irish regimes, privacy impact assessments, privacy by design sign off, and handling of privacy complaints.
• Information governance: data classification, retention and disposal, and records management.
• Policy framework: own the overarching security and information policy suite, drawing on technical input from Director AI & Security and Head of Technology.
• Regulatory and contractual reporting: regulatory breach notification, compliance clauses in customer and government contracts, and responses to customer and government due diligence questionnaires.
• Information security risk and governance reporting: maintain the compliance risk register, and aggregate infor
•