Privacy Assurance & Compliance Specialist

About the role

The Privacy Assurance & Compliance Specialist will manage and support the day-to-day delivery of Everway’s global privacy assurance and compliance programme, supporting the Director of Compliance in their capacity as Data Protection Officer (DPO).

The role will help ensure that privacy and data protection requirements are embedded into Everway’s products, systems and business processes and that privacy risks, controls and regulatory obligations are effectively identified, managed, monitored and evidenced.

Working closely with Legal, Data Governance, Information Security, Product, Engineering, People and other business teams, the role will provide practical privacy guidance and independent compliance oversight while helping Everway maintain a scalable and audit-ready privacy programme across evolving frameworks.

The role is focused on privacy assurance, risk, governance and compliance. Legal retains responsibility for contractual privacy matters and legal advice, while business and data owners remain accountable for the data and processing activities within their areas.

Main Responsibilities

• Supporting the Director Compliance, to implement and deliver the privacy workstream of the compliance roadmap, ensuring the company meets its legal, regulatory and reputational responsibilities.
• Support and lead specific workstreams within the Compliance roadmap and business improvement projects/initiatives, for example data mapping, risk management, controls testing and policy development.
• Lead and coordinate Data Protection Impact Assessments (DPIAs) on products, systems, and processes, tracking risk treatments and embedding Privacy-by-Design from the outset.
• Manage the framework for Data Subject Access Requests (DSARs) and Data Deletion Requests, ensuring robust processes with system owners to assure quality and timeliness.
• Identify privacy risks and controls, translating them into practical business processes to improve organisational compliance and supporting incident management.
• Address privacy-focused vendor security inquiries from customers and collaborate with Legal on related requests.
• Maintain and enhance the Knowledge Base and Trust Centre resources to ensure up-to-date compliance documentation.
• Conduct comprehensive internal Vendor Security Reviews to assess and mitigate third-party privacy risks.
• Develop, implement and maintain internal privacy policies, external privacy notices, procedures and ELT/governance reporting including KPIs.
• Lead privacy assurance activities supporting audit and certification initiatives (eg ISO 27701, ISO 27001, ISAE 3000, SOC 2) and manage central evidence within GRC tools.
• Monitor regulatory developments, assist with regulator/auditor interactions, and liaise with external and internal legal counsel as applicable on cross-jurisdictional privacy matters.

Essential Criteria

• Degree level (or equivalent) qualification in a related discipline (eg Law, Data Protection, Information Security, Compliance or Risk)
• 2+ years experience in a similar role in data privacy compliance or privacy assurance role, ideally within a software, SaaS or international tech environment.
• Sound working knowledge of EU GDPR, including risk and compliance management
• Ability to work independently and effectively manage and prioritise workstreams in a dynamic environment.
• Practical experience supporting DPIAs, DSAR/data deletion requests, ROPAs, incident response, and vendor privacy reviews.
• Proven experience translating regulatory requirements into clear, practical business processes and controls.
• Strong cross-functional stakeholder management and communication skills.
• Detail-oriented with strong analytical, problem-solving, and organizational skills.

Desirable Criteria

• Experience working within a SaaS, Edtech or software development environment
• Knowledge of ISO 27001, ISO 27701, ISAE 3000, ISO 42001 or SOC 2 frameworks
• Familiarity with GRC platforms (such as Vanta, One Trust)
• Relevant privacy or audit qualifications (e.g., CIPP/E, CIPM, or ISO internal auditor training).
• Proficiency with Google Workspace, docs, chat, drive

Please submit your application by Thursday 15th October 2026.

Please note: applications may close early due to high demand, so early submission is encouraged.

#everway