Compliance Manager, Sona

• 5+ years' experience in information security, compliance or closely related roles
• Hands-on experience leading or materially contributing to external certifications (e.g. ISO 27001, GDPR, SOC 2, Cyber Essentials)
• Experience in a SaaS or technology environment, ideally a startup or scale-up
• Strong understanding of security controls and how to implement them in practice (not just on paper)
• Experience working directly with tools, vendors and configurations (not purely advisory)
• A pragmatic, risk-based mindset with the ability to push back clearly and constructively
• A genuine enthusiasm for AI — demonstrable examples of using AI tools to improve how you work, whether professionally or personally
• Comfortable working in a hybrid model: 2-3 days per week in our London Soho office

Desirable

• As we scale across the UK and US, we're looking for a hands-on Compliance Manager with a strong information security background to own and evolve our security and compliance foundations
• This role is InfoSec-led, with ISO 27001 as an immediate priority and SOC 2 likely in the medium term
• You'll work closely with Product, Engineering, Legal and Leadership to translate compliance requirements into practical, working systems that support growth rather than slow it down
• As this is our first full-time compliance hire, it is a fantastic opportunity to fully own and craft a robust, scaleable compliance programme in a fast-growing software business
• If this idea sounds exciting, we want to hear from you!
• Own and lead information security across the business, including policies, controls and risk management
• Lead external certifications and audits (e.g. ISO 27001, GDPR, SOC 2, Cyber Essentials)
• Work cross-functionally to advise teams on risk and data security, supporting them with use of new tools and AI adoption
• Translate security and compliance requirements into concrete systems, tools and processes
• Own or lead implementation of technical controls (e.g. access management, logging, monitoring, incident response, device management)
• Act as the point of contact for RFPs, customer security reviews, questionnaires and audits
• Support and develop AML compliance, extending depth over time where needed
• Proactively identify and implement AI-driven improvements to compliance workflows, tooling and processes