Blue Matter
Information Security & Compliance Manager
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Information Security & Compliance Specialist
Blue Matter
About Us
Blue Matter is a rapidly growing strategic consulting firm serving clients in the life sciences industry. We partner with our clients to help them achieve commercial success across the product lifecycle, portfolio, and organisational strategy. Our expertise spans new product planning, brand/lifecycle planning, and corporate strategy in specialty therapeutic areas.
We foster a unique entrepreneurial culture, investing in growth to become one of the best places to work. Our global presence includes offices in:
- US: San Francisco, New York, Boston
- Europe: London, Zurich, Netherlands
- India: Mumbai, Gurgaon, Pune
Why This Role Exists
Our clients are among the most security- and privacy-conscious organisations globally, trusting us with highly sensitive commercial and scientific data. Our internal AI platform, BlueCortex, is central to serving them—which raises both stakes and opportunities in data and technology governance.
As we grow, we need a dedicated owner of information security and compliance. This role sits in our Technology & Operations team based in the UK, ensuring strong alignment with:
- GDPR and UK GDPR obligations
- European clients and subsidiaries
- Global team support across time zones
This isn’t a tick-box function; it’s a hands-on, high-impact role where you’ll build and run the firm’s security and compliance program end-to-end—and become the trusted client point of contact for data protection questions.
What You’ll Do
Security Governance & Strategy
- Own and execute Blue Matter’s full information security program (including BlueCortex governance).
- Define, maintain, and operationalise security policies, standards, and procedures, ensuring they scale with the firm.
- Manage the risk register, perform regular risk assessments, and drive risk remediation to closure.
- Report on security and compliance posture clearly and actionably to leadership.
Compliance & Certifications
- Lead ISO 27001 and SOC 2 certification efforts by designing control frameworks, managing documentation, and coordinating internal and external audits.
- Establish a sustainable, audit-ready culture—avoiding last-minute scrambles.
- Track regulatory updates (e.g., GDPR, NIS2, DORA) and translate them into actionable strategies.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Data Protection & Privacy
- Oversee GDPR and UK GDPR compliance, acting as (or closely supporting) the Data Protection function.
- Maintain Records of Processing Activities (RoPA), conduct Data Protection Impact Assessments (DPIAs), and govern data retention and minimisation policies.
- Handle data subject requests and manage personal data breaches, including regulator and individual notifications.
- Manage data transfers and residency across global subsidiaries.
Client Security Assurance
- Lead responses to client security due diligence, including completing security questionnaires and assessments accurately and on schedule.
- Support contractual discussions on security/privacy/data protection terms (e.g., Data Processing Agreements).
- Maintain a reusable knowledge library (certifications, documentation, answers) to accelerate client reviews.
Microsoft 365 Security Operations
- Secure and manage our Microsoft 365 environment (Entra ID, Microsoft Defender, Microsoft Purview, Intune).
- Own identity and access management (conditional access, MFA, privileged access, onboarding/offboarding, least-privilege policies).
- Implement data loss prevention, information protection, and device compliance policies.
- Partner with IT on secure configurations, patching, and endpoint hardening.
Third-Party & Vendor Risk
- Execute third-party risk assessments, evaluate new AI/SaaS/AML tools, and maintain vendor risk monitoring.
- Track vendor data access and reassess risk periodically.
Incident Response & Investigations
- Develop and lead the incident response plan (detection, triage, containment, post-incident review).
- Investigate security events (e.g., analysing Entra ID logs), generating clear incident reports.
- Conduct tabletop exercises to prepare the firm for real incidents.
Security Awareness & Culture
- Design and deliver security awareness training and phishing simulations.
- Foster a security-as-a-shared-responsibility culture across the firm.
What Success Looks Like
First 90 Days
- Conduct a posture assessment, identify high-priority risks and gaps, and craft a clear, prioritised roadmap.
- Become the primary contact for client security questionnaires.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
First 6 Months
- Core security policies implemented and adopted.
- Microsoft 365 security stack strengthened.
- Operational vendor risk management and incident response processes.
- Certification/attestation work underway with a strong plan.
First Year
- Firm has a mature, sustainable security and compliance program.
- Defensible GDPR/UK GDPR data protection posture.
- Faster and smoother client security reviews.
What You’ll Bring
Required
- 5+ years in information security, governance, risk, and compliance (GRC), ideally in regulated industries (e.g., pharma, professional services, SaaS).
- Practical GDPR/UK GDPR expertise (including daily application).
- Hands-on ISO 27001 and SOC 2 implementation/audit experience.
- Familiarity with Microsoft security tools (Entra ID, Defender, Purview, Intune).
- Experience with client/customer security questionnaires and assessments.
- Relevant certifications (CISSP, CISM, CISA, CRISC, ISO 27001 Auditor Implementer, CIPP/E, or CIPM) or equivalent experience.
- UK-based with work eligibility and ability to support global time zones.
Strongly Preferred
- Experience building/maturing, not just maintaining, security/compliance programs.
- Knowledge of EU/UK regulations such as NIS2 and DORA.
- Third-party/vendor risk management for AI/SaaS environments.
Nice to Have
- Exposure to life sciences or pharma, including familiarity with GxP, GDP, or healthcare data (e.g., HIPAA considerations).
- Experience designing data protection or data-risk frameworks.
- Support in M&A or subsidiary security/compliance integration.
Who Thrives Here
- Builders who love owned programs—not just maintenance.
- Pragmatic risk managers who balance security with business realism.
- Clear communicators who earn trust across clients, leadership, and technical teams.
- Enthusiasts fascinated by AI-driven security challenges.
How We Work
A small, capable Technology & Operations team with autonomy and leadership access. You’ll:
- Design the program your way.
- Own end-to-end ownership with visible impact as the firm’s security lead.
- Work in a remote/hybrid role in the UK and support occasional in-office collaboration.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location