Compliance Manager - Remote

Job title: Compliance ManagerReport to: Operations Director

Location: Remote within the UK, with regular travel to our group companies and to clients, typically four to six days a month, more around auditsHours: Monday to Friday, 09:00 to 18:00 (40 hours a week)About usOwlis is a UK IT managed services group, backed by private equity, that grows by bringing established regional IT providers together on one platform.

Each business keeps its own name and its local relationships. Behind it sits one set of systems, one set of policies, and a group with the depth to support it properly. Together, we look after small and medium-sized businesses across the UK with managed IT, cybersecurity, and AI and transformation services.About the roleOur compliance strategy is written. This role makes it happen. First, it takes every company in our group to ISO 9001, ISO 27001, ISO/IEC 42001 and Cyber Essentials Plus, with controls aligned to the NCSC Cyber Assessment Framework (CAF) v4.0. Second, it builds the compliance service we offer clients covering the same standards plus UK GDPR and DORA: configuring the tools, writing the templates and collateral, and delivering the first engagements.Core systemsCompliance Manager GRC (Kaseya): frameworks, assessments, evidence collection, risk register (administrator and owner)Network Detective and VulScan (Kaseya) for assessment and technical evidence (user)myITprocess (Kaseya) for compliance project plans and client roadmaps (user)BullPhish ID (Kaseya) for staff security and compliance training (administrator)Microsoft 365 (SharePoint, Purview), HaloPSA and Employment Hero for policy acknowledgement and recordsWhat you will be doingGroup certification programmeGap-assess every group company against ISO 9001, ISO 27001, ISO/IEC 42001 and Cyber Essentials Plus, and agree a certification plan with datesBuild and run one integrated management system: risk register, statement of applicability, policies, objectives and management reviewsAlign group controls to the NCSC Cyber Assessment Framework (CAF) v4.0Plan and carry out internal audits; track corrective actions to closure; prepare for and host certification auditsAchieve and maintain Cyber Essentials Plus for each company, working with our engineers on the technical controlsSupport the DPO with records of processing, DPIAs, data subject requests and breach handling under UK GDPRClient compliance serviceBuild the service from the written strategy, covering ISO 9001, ISO 27001, ISO/IEC 42001, Cyber Essentials Plus, UK GDPR and DORAReadiness, ad-hoc compliance and gap assessments, with a standard method and reportInternal audit support for clients (certification itself is carried out by accredited bodies)A policy and procedure template library clients can adoptAutomated evidence collection and continuous monitoring in Compliance Manager GRCRisk register management for clientsEmployee security and compliance training programmes, using BullPhish IDCompliance project plans and roadmaps in myITprocessCompliance as a Service: an ongoing monthly service combining the aboveTechnical controls: define the control baselines and evidence, and check them with our engineers, who make any changes with the client's sign-offGRC toolsAdminister and maintain our Kaseya GRC stack: Compliance Manager GRC, Network Detective, VulScan, myITprocess and BullPhish IDKeep frameworks, templates, integrations and reporting current as standards changeTraining, collateral and oversightProduce service collateral, playbooks and sales enablement material from the written go-to-market planTrain account managers and engineers in every group company to sell and support the serviceReview compliance deliverables across the group before they go to clientsBudget, reporting and go-to-marketProvide budget and pricing inputs to the Operations Director and the commercial ownerCarry out the go-to-market plan and report progress, risks, audit results and service pipeline monthlyOutcomes and KPIsIn the first 90 days: gap assessment of every group company against ISO 9001, ISO 27001, ISO/IEC 42001 and Cyber Essentials Plus complete, with a certification plan and dates agreed; our GRC tools configured for the group programme; first service templates and collateral drafted from the written strategy.By 6 months: one management system running across the group (risk register, statement of applicability, policies, internal audits) with automated evidence collection live; Cyber Essentials Plus achieved or booked for each company; first client readiness assessments delivered; staff security training running across the group.By 12 months: ISO 27001 and ISO 9001 certification audits completed for the group, ISO/IEC 42001 under way; Compliance as a Service live with first clients; account managers and engineers in every group company trained to sell and support it.CompetenciesClear evidence of taking organisations to ISO 27001 certification, ideally with ISO 9001 and Cyber Essentials Plus, across more than one businessPlans certification in a clear, realistic, risk-based sequence, uses evidence from real operation, shares controls, policies and audits across standards, and knows what certification bodies look forBrings companies along by explaining why in their terms, involving local leaders, keeping controls proportionate, showing polite persistence and escalating early with a recommendationMaps controls to evidence sources, schedules technical scans, separates technical from process evidence, reviews exceptions and keeps evidence auditable and reusable across standardsPrioritises by risk and audit dates, reuses one set of controls and evidence for the group and the client service, and keeps plans realistic for one person with engineer support, with clear measuresExplains to clients what we do and what stays with them, that certification comes from an accredited body, offers readiness work and points to legal advice where neededHandles a breach first, with the DPO and incident owner, uses clear criteria for everything else and communicates the trade-offsTeaches people to own their controls, with collateral and guides others can use without them in the roomTells people early and plainly, with options, and follows throughEssential skills and experienceHas implemented ISO 27001 and taken an organisation through certification audits, including risk assessment, statement of applicability and internal auditHas run ISO 9001 or another management system standard alongside ISO 27001 as one integrated systemHas prepared organisations for Cyber Essentials Plus, including checking the technical controls behind itApplies UK GDPR in practice: records of processing, DPIAs and breach handlingHas configured and run a GRC or compliance platform, including automated evidence collection and risk registersWrites clear policies, procedures and client-facing collateral that auditors and non-specialists can followDesirable skills and experienceKnowledge of ISO/IEC 42001 or another AI governance frameworkHas worked with the NCSC Cyber Assessment FrameworkHas supported financial services clients with DORA or similar requirementsISO 27001 Lead Implementer or Lead Auditor certificateHas delivered compliance or GRC services to clients in an IT managed services providerHas run a security awareness training programme, including phishing simulationsDevelopmentWe expect the role to grow as the service grows: towards owning the compliance budget, and leading a small team, starting with a Compliance Analyst under a separate business case. Lead Implementer or Lead Auditor training is supported where it fits the work.Our recruitment processOur process usually has four stages:A short pre-screening call with our HR / Recruitment team.A competency interview with the Operations DirectorA case study on a certification and service plan for the groupA short final call with an Owlis Group executive, after which we aim to make an offer.Any offer is conditional on two satisfactory professional references from employers named on your CV (with a work email address for each), proof of your right to work in the UK and, where required, a DBS check. We are unable to offer visa sponsorship.Please note that this is a job advertisement rather than a full job description. The complete job description will be shared with you alongside your contract of employment.Equal opportunitiesThe Owlis Group is an equal opportunities employer. We welcome applications from everyone and make recruitment decisions on the basis of skills, experience and potential, regardless of age, disability, gender reassignment, marriage or civil partnership, pregnancy or maternity, race, religion or belief, sex or sexual orientation. If you need any adjustments to take part fully in the recruitment process, please let us know and we will be glad to help.