Pave Talent Partners
Compliance, Assurance & Security Manager Inside IR35 Contract
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Compliance, Assurance & Security Manager
3 Month Contract, Inside IR35 Day Rate
Manchester Based, Hybrid
Immediate Start Date
The Opportunity
Our client is ISO 27001:2022 certified and PCI-DSS v4.0.1 compliant, with security playing a critical role in the way we operate and grow. As our AI platform becomes increasingly embedded within customer workflows and the regulatory environment continues to develop, we are creating a dedicated role to take ownership of our security, compliance and assurance activities.
This is a newly created position, bringing together responsibilities that have previously been shared across different areas of the business. The successful candidate will have ownership of the operational security and compliance function, ensuring our controls remain effective, our evidence is robust and our overall security posture continues to mature.
This is a practical, hands-on role rather than a purely governance-focused position. We are looking for someone who understands compliance frameworks, enjoys working with detail and takes genuine ownership of delivering outcomes. The role covers a broad range of activities, including ISMS management, audit preparation, customer security assessments, penetration testing coordination and monitoring emerging regulatory requirements. It is an opportunity to build and develop a function that already has a strong foundation.
What You Will Own
ISMS Management & Continuous Improvement
- Take day-to-day ownership of Infinity's Information Security Management System (ISMS), ensuring policies, records and documentation remain accurate, current and ready for audit.
- Review and assess our existing ISO 27001:2022 compliance framework, building on our current certification and identifying opportunities to strengthen and improve controls.
- Maintain the risk register, asset register and control framework, ensuring they accurately reflect the current organisation rather than becoming static compliance documents.
- Manage the internal audit programme and coordinate external certification audits, acting as the key contact for our certification body.
- Review and update policies, procedures and supporting documentation as the business develops, particularly in relation to our growing AI platform and agentic delivery practices.
PCI-DSS & Regulatory Compliance
- Take operational ownership of PCI-DSS v4.0.1 compliance, coordinating evidence, working with our QSA and ensuring controls remain effective throughout the year.
- Maintain practical knowledge of GDPR and ICO requirements as they relate to data processing activities.
- Identify and escalate potential compliance risks, support Data Protection Impact Assessments (DPIAs) and ensure privacy and compliance considerations are incorporated into product and platform decisions.
- Monitor changes to the regulatory landscape, including NIS2 and potential future SOC 2 requirements, providing the CTO with clear visibility of upcoming obligations and required actions.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Security Operations & Assurance
- Work alongside the Head of DevOps to develop the approach to continuous penetration testing, coordinating activity with our testing partner and ensuring findings are tracked, remediated and appropriately evidenced.
- Manage the InfoSec request process, including customer and prospect security questionnaires, due diligence exercises and vendor assessments.
- Develop and maintain a central library of security responses and supporting evidence to improve efficiency and consistency.
- Maintain oversight of key security controls and tooling, working with DevOps on areas such as vulnerability management, access control and security scanning.
- Ensure the technical controls supporting our certification and compliance requirements are operating effectively.
- Support incident response activities by maintaining the incident response plan, organising tabletop exercises and helping ensure the business is prepared to respond effectively to security incidents.
Reporting & Visibility
- Provide regular security and compliance updates to the CTO and senior leadership team, presenting a clear picture of our security posture, outstanding risks and remediation progress.
- Develop meaningful security metrics, reporting and dashboards that provide clear visibility of performance and risk.
- Ensure reporting can effectively support both internal governance and external stakeholders, including customers, auditors and prospective enterprise clients.
- Support Sales and Customer Success during commercial conversations by providing accurate security evidence, information and context where security requirements form part of the buying or retention process.
AI Governance & Emerging Requirements
- Work with the Head of AI Platform & Applied Intelligence to develop and maintain appropriate AI governance as Infinity's AI capabilities continue to expand.
- Help ensure the organisation is prepared for requirements associated with ISO/IEC 42001 and other emerging AI governance and compliance expectations.
- Ensure security, privacy and compliance requirements are considered during the design and development of new AI features and platform capabilities, rather than being addressed retrospectively.
AI-Augmented Security & Compliance
- Identify and implement opportunities to use AI tools to make security and compliance activities more efficient and effective.
- Explore the use of AI for areas such as evidence gathering, policy maintenance, security questionnaire responses and monitoring emerging risks.
- Keep up to date with the evolving relationship between AI, cybersecurity and compliance, understanding both how Infinity can use AI to strengthen its controls and how emerging frameworks are responding to AI-related risks.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
What We Are Looking For
Essential
- Strong practical knowledge of ISO 27001, ideally with hands-on experience operating an ISMS, supporting certification audits and managing continual improvement.
- Practical experience of PCI-DSS and GDPR within a B2B SaaS, technology or similar environment, with the ability to translate requirements into effective controls and evidence.
- A highly organised and detail-focused approach, with a strong sense of personal ownership and accountability.
- Excellent written communication skills, with the ability to produce clear policies, reports and security responses for a range of technical and non-technical audiences.
- Strong organisational and prioritisation skills, with the ability to manage multiple concurrent activities including audits, customer requests, remediation actions and policy reviews.
- Comfortable operating as an individual contributor, influencing stakeholders across the organisation without relying on formal authority.
- A proactive approach to identifying issues, following through on actions and continuously improving processes.
Highly Desirable
- Experience completing enterprise InfoSec questionnaires and supporting customer security due diligence in a commercial environment.
- Experience with continuous penetration testing, including coordinating testing, reviewing findings and managing remediation through to completion.
- Knowledge of NIS2 and SOC 2, including an understanding of their requirements and what preparation would involve.
- Experience or knowledge of AI governance frameworks, particularly ISO/IEC 42001, or a strong interest in developing expertise in this area.
- Experience working within a cloud-native technology environment, with an understanding of AWS infrastructure, serverless architectures and SaaS delivery models.
- Relevant professional qualifications such as CISSP, CISM, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer or equivalent experience.
Interested?
If you're an experienced Compliance, Assurance & Security professional who can be readily available for an interim assignment, we'd love to hear from you.
Apply now or get in touch with Pave Talent Partners for a confidential conversation.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills