Compliance Manager

Job title: Compliance Manager

Report to: Operations Director

Location: Remote within the UK, with regular travel to our group companies and to clients, typically four to six days a month, more around audits

Hours: Monday to Friday, 09:00 to 18:00 (40 hours a week)

About us

Owlis is a UK IT managed services group, backed by private equity, that grows by bringing established regional IT providers together on one platform. Each business keeps its own name and its local relationships. Behind it sits one set of systems, one set of policies, and a group with the depth to support it properly. Together, we look after small and medium-sized businesses across the UK with managed IT, cybersecurity, and AI and transformation services.

About the role

Our compliance strategy is written. This role makes it happen. First, it takes every company in our group to ISO 9001, ISO 27001, ISO/IEC 42001 and Cyber Essentials Plus, with controls aligned to the NCSC Cyber Assessment Framework (CAF) v4.0. Second, it builds the compliance service we offer clients covering the same standards plus UK GDPR and DORA: configuring the tools, writing the templates and collateral, and delivering the first engagements.

Core systems

• Compliance Manager GRC (Kaseya): frameworks, assessments, evidence collection, risk register (administrator and owner)
• Network Detective and VulScan (Kaseya) for assessment and technical evidence (user)
• myITprocess (Kaseya) for compliance project plans and client roadmaps (user)
• BullPhish ID (Kaseya) for staff security and compliance training (administrator)
• Microsoft 365 (SharePoint, Purview), HaloPSA and Employment Hero for policy acknowledgement and records

What you will be doing

Group certification programme

• Gap-assess every group company against ISO 9001, ISO 27001, ISO/IEC 42001 and Cyber Essentials Plus, and agree a certification plan with dates
• Build and run one integrated management system: risk register, statement of applicability, policies, objectives and management reviews
• Align group controls to the NCSC Cyber Assessment Framework (CAF) v4.0
• Plan and carry out internal audits; track corrective actions to closure; prepare for and host certification audits
• Achieve and maintain Cyber Essentials Plus for each company, working with our engineers on the technical controls
• Support the DPO with records of processing, DPIAs, data subject requests and breach handling under UK GDPR

Client compliance service

• Build the service from the written strategy, covering ISO 9001, ISO 27001, ISO/IEC 42001, Cyber Essentials Plus, UK GDPR and DORA
• Readiness, ad-hoc compliance and gap assessments, with a standard method and report
• Internal audit support for clients (certification itself is carried out by accredited bodies)
• A policy and procedure template library clients can adopt
• Automated evidence collection and continuous monitoring in Compliance Manager GRC
• Risk register management for clients
• Employee security and compliance training programmes, using BullPhish ID
• Compliance project plans and roadmaps in myITprocess
• Compliance as a Service: an ongoing monthly service combining the above
• Technical controls: define the control baselines and evidence, and check them with our engineers, who make any changes with the client's sign-off

GRC tools

• Administer and maintain our Kaseya GRC stack: Compliance Manager GRC, Network Detective, VulScan, myITprocess and BullPhish ID
• Keep frameworks, templates, integrations and reporting current as standards change

Training, collateral and oversight

• Produce service collateral, playbooks and sales enablement material from the written go-to-market plan
• Train account managers and engineers in every group company to sell and support the service
• Review compliance deliverables across the group before they go to clients

Budget, reporting and go-to-market

• Provide budget and pricing inputs to the Operations Director and the commercial owner
• Carry out the go-to-market plan and report progress, risks, audit results and service pipeline monthly

Outcomes and KPIs

• In the first 90 days: gap assessment of every group company against ISO 9001, ISO 27001, ISO/IEC 42001 and Cyber Essentials Plus complete, with a certification plan and dates agreed; our GRC tools configured for the group programme; first service templates and collateral drafted from the written strategy.
• By 6 months: one management system running across the group (risk register, statement of applicability, policies, internal audits) with automated evidence collection live; Cyber Essentials Plus achieved or booked for each company; first client readiness assessments delivered; staff security training running across the group.
• By 12 months: ISO 27001 and ISO 9001 certification audits completed for the group, ISO/IEC 42001 under way; Compliance as a Service live with first clients; account managers and engineers in every group company trained to sell and support it.

Competencies

• Clear evidence of taking organisations to ISO 27001 certification, ideally with ISO 9001 and Cyber Essentials Plus, across more than one business
• Plans certification in a clear, realistic, risk-based sequence, uses evidence from real operation, shares controls, policies and audits across standards, and knows what certification bodies look for
• Brings companies along by explaining why in their terms, involving local leaders, keeping controls proportionate, showing polite persistence and escalating early with a recommendation
• Maps controls to evidence sources, schedules technical scans, separates technical from process evidence, reviews exceptions and keeps evidence auditable and reusable across standards
• Prioritises by risk and audit dates, reuses one set of controls and evidence for the group and the client service, and keeps plans realistic for one person with engineer support, with clear measures
• Explains to clients what we do and what stays with them, that certification comes from an accredited body, offers readiness work and points to legal advice where needed
• Handles a breach first, with the DPO and incident owner, uses clear criteria for everything else and communicates the trade-offs
• Teaches people to own their controls, with collateral and guides others can use without them in the room
• Tells people early and plainly, with options, and follows through

Essential skills and experience

• Has implemented ISO 27001 and taken an organisation through certification audits, including risk assessment, statement of applicability and internal audit
• Has run ISO 9001 or another management system standard alongside ISO 27001 as one integrated system
• Has prepared organisations for Cyber Essentials Plus, including checking the technical controls behind it
• Applies UK GDPR in practice: records of processing, DPIAs and breach handling
• Has configured and run a GRC or compliance platform, including automated evidence collection and risk registers
• Writes clear policies, procedures and client-facing collateral that auditors and non-specialists can follow

Desirable skills and experience

• Knowledge of ISO/IEC 42001 or another AI governance framework
• Has worked with the NCSC Cyber Assessment Framework
• Has supported financial services clients with DORA or similar requirements
• ISO 27001 Lead Implementer or Lead Auditor certificate
• Has delivered compliance or GRC services to clients in an IT managed services provider
• Has run a security awareness training programme, including phishing simulations

Development

We expect the role to grow as the service grows: towards owning the compliance budget, and leading a small team, starting with a Compliance Analyst under a separate business case. Lead Implementer or Lead Auditor training is supported where it fits the work.

Our recruitment process

Our process usually has four stages:

• A short pre-screening call with our HR / Recruitment team.
• A competency interview with the Operations Director
• A case study on a certification and service plan for the group
• A short final call with an Owlis Group executive, after which we aim to make an offer.

Any offer is conditional on two satisfactory professional references from employers named on your CV (with a work email address for each), proof of your right to work in the UK and, where required, a DBS check. We are unable to offer visa sponsorship.

Please note that this is a job advertisement rather than a full job description. The complete job description will be shared with you alongside your contract of employment.

Equal opportunities

The Owlis Group is an equal opportunities employer. We welcome applications from everyone and make recruitment decisions on the basis of skills, experience and potential, regardless of age, disability, gender reassignment, marriage or civil partnership, pregnancy or maternity, race, religion or belief, sex or sexual orientation. If you need any adjustments to take part fully in the recruitment process, please let us know and we will be glad to help.