Compliance and Information Security Manager, Konfir

• Track record of building & driving automation or process improvement in compliance/security contexts
• Proven experience in compliance, data protection, and/or information security roles
• Strong knowledge of UK GDPR, DPA 2018, and relevant standards (e.g. ISO27001)
• Ability to translate regulation into clear, actionable guidance for teams
• Excellent communication skills

Desirable

• Konfir is growing fast and we’re doing it efficiently. We’re building a lean, high-impact team and prioritising automation at every level to reduce manual effort and scale responsibly. We're now looking for a Compliance and Information Security Manager to play a key role in enabling this growth
• We want someone who can identify where human oversight is needed — and where it isn’t. You'll work across teams to design compliance systems that support rather than slow us down. This role suits someone collaborative, comfortable with ambiguity, and motivated by the challenge of building secure, trustworthy foundations without bureaucracy
• This is a great opportunity for someone ready to step into a broader, more strategic role, combining hands-on execution with long-term thinking in a fast-moving startup environment. You’ll lead on data protection, regulatory compliance, and cyber security, acting as our DPO and embedding scalable, automated, and proportionate controls across the business
• Own and manage regulatory compliance frameworks (e.g. UK GDPR, DPA 2018, ISO27001, FCA AISP)& Risk
• Develop, maintain, and continuously improve internal policies, procedures, and controls across data protection, information security, and regulatory risk
• Lead the strategy and delivery of compliance automation, identifying and implementing solutions that minimise manual effort and scale with the business
• Conduct regular compliance monitoring and internal audits, escalating issues where required
• Stay up to date with regulatory changes, assessing their impact and driving rapid alignment
• Serve as the company’s Data Protection Officer (DPO), ensuring lawful, ethical, and efficient handling of personal data
• Respond to subject access requests (SARs), data breaches, and regulator communications — streamlining where possible
• Maintain the Record of Processing Activities (ROPA) and conduct Data Protection Impact Assessments (DPIAs)
• Deliver company-wide data protection training and awareness in scalable, automated ways
• Design and maintain technical and organisational security controls (e.g. access management, encryption, incident response) that scale with minimal overhead
• Monitor systems and suppliers for threats and incidents, and lead prompt responses
• Lead or support external security certification efforts (e.g. ISO27001)
• Manage vendor security risk assessments and due diligence
• Provide regular updates to leadership on compliance and infosec risks, metrics, and incidents — focusing on clarity, insight, and actionability
• Maintain risk registers and support board-level reporting and assurance exercises
• Partner with teams to embed automation-friendly compliance and security practices into everyday workflows

• 30 minute intro with the Head of Operations
• Task based interview
• Meet key members of the Leadership Team