Information Security, Compliance & Data Protection Manager

Client security assurance

• Own the response to client security due-diligence: complete security questionnaires and assessments from biopharma and medtech clients accurately and on time.
• Support commercial and contractual discussions on security, privacy, and data processing terms (e.g., DPAs).
• Maintain a library of reusable security documentation, certifications, and answers to accelerate client reviews.

Microsoft 365 security operations

• Secure and govern our Microsoft 365 (E5) environment — Entra ID, Microsoft Defender, Microsoft Purview, and Intune.
• Own identity and access management: conditional access, MFA rollout, privileged access, joiner/mover/leaver processes, and least-privilege enforcement.
• Implement and tune data loss prevention (DLP), information protection/labelling, and device compliance.
• Partner with IT on secure configuration, patching, and endpoint hardening.

EU Operations IT support

• Provide hands-on IT support for the EU Operations team, including on-site technical assistance when needed.
• Act as the day-to-day technology point of contact for European colleagues, ensuring they have the tools and infrastructure to work effectively.
• Support the growth of EU operations from a technology and compliance standpoint as the firm continues to expand in Europe.

Third-party and vendor risk

• Run third-party and vendor risk management across our supply chain, including security review of new tools and AI/SaaS vendors.
• Maintain an inventory of vendors and their data access, and reassess risk on a regular cadence.

Incident response and investigations

• Own and update the incident response plan; lead detection, triage, investigation, containment, and post-incident review.
• Investigate security events (for example, analysing Entra ID sign-in and audit logs), and produce clear, actionable incident reports.
• Run tabletop exercises so the firm is prepared before an incident happens.

Security awareness and culture

• Build and deliver security awareness training and phishing simulations.
• Make security approachable and practical so the whole firm becomes a partner in protecting client data.

What you’ll bring

Required

• 5+ years of combined IT and information security/GRC experience, ideally in an environment that handles sensitive client data — such as regulated industries, professional services, defence, government, or pharma.
• Strong, practical knowledge of GDPR and UK GDPR and day-to-day data protection, with experience navigating cross-border data transfer complexities. Bonus if you’ve been through a GDPR audit or worked for a multinational with operations both inside and outside the EU.
• Hands-on experience with ISO 27001 and/or SOC 2 implementation and audits.
• Core IT administration abilities — comfortable providing hands-on technical support alongside governance and strategy work.
• Working familiarity with the Microsoft 365 security stack (Entra ID, Defender, Purview, Intune).
• Experience responding to client/customer security assessments and questionnaires.
• AI fluency and day-to-day use of automation tools in your workflow — we’re an AI-forward firm and expect the same mindset from this role.
• Based in the UK with the right to work, ideally in or near London (the role is hybrid, occasional office presence is required).
• Excellent written and verbal communication: you can translate security and risk into plain business language for leadership, clients, and colleagues.

Strongly preferred

• Experience standing up or maturing a security/compliance programme (not only operating an established one).
• Experience serving as or supporting a Data Protection Officer (DPO) function.
• Familiarity with EU and UK regulatory developments such as NIS2 and DORA.
• Experience managing third-party/vendor risk for SaaS and AI tooling.

Nice to have

• Exposure to life sciences or pharma, and awareness of GxP, GDP, or healthcare data considerations (e.g., HIPAA for US-facing work).
• Experience establishing data-protection or data-risk practices.
• Experience supporting M&A or subsidiary integration from a security and compliance perspective.
• Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer/Auditor, CIPP/E, or CIPM — valued but not required; we prioritise practical experience.

Who thrives here

• Builders who want to own a programme and shape it, not just keep the lights on.
• Self-starters who proactively identify problems and propose solutions — we don’t want someone who waits to be told what to do.
• Pragmatic risk managers who right-size controls to the business instead of defaulting to maximum friction.
• Versatile operators comfortable moving between compliance strategy, hands-on security configuration, and IT support for colleagues.
• Clear communicators who earn trust with clients, leadership, and engineers alike.
• People genuinely interested in the security and governance challenges of a modern, AI-forward firm.

How we work

A small, capable Technology & Operations team with real ownership and direct access to leadership. You’ll report to the Director of IT & Security with a dotted line to the EU Operations team. You’ll have the autonomy to build the programme the right way — and the visibility that comes with being the firm’s security and compliance lead. This is a hybrid role based in the UK with on-site presence as needed.

Please note: we only email from @bluematterconsulting.com or our JazzHR applicant system. Every open role is listed at bluematterconsulting.applytojob.com, and we never ask for payment, banking details, or equipment purchases.