Compliance Officer, Business

Location

UK remote - fully remote

37.5 hours

Up to £45,000 per annum

Energy Sys is a platform used by software builders and consultants who serve oil and gas companies. Our partners build applications on top of us, and those applications run some of the most critical data and reporting workflows in the energy sector. We’ve been around for over 20 years, which means we’re not a startup bet. We’re an established business with a real product, real customers, and a PE‑backed growth target.

Energy Sys is shifting towards a high‑performing, high‑trust environment based on freedom and responsibility. That means we expect our people to take ownership, use their judgement, and care deeply about their impact. In return, we give them the space and trust to do the job the way they believe is best. This role is perfect for someone who wants to lead and build, not just follow a playbook.

As the business scales, the need for structured governance, process integrity, and accountability across day‑to‑day operations has become a strategic priority. This role exists to own that accountability. The postholder will serve as the operational backbone of the company—ensuring that internal processes are documented, consistently applied, and aligned with applicable regulatory requirements. Working closely with the CEO and leadership team, they will maintain clear ownership of cross‑functional projects, people‑related processes, and compliance‑sensitive workflows, ensuring that nothing falls through the gaps as the business grows.

• Audit & Certification

  You’ll own the ongoing SOC 2 Type II and ISO 27001:2022 audit lifecycle for an already‑certified organisation: surveillance and recertification audit planning, evidence readiness, auditor liaison, and remediation tracking. You’ll maintain the ISMS (including the Statement of Applicability) and handle customer security assessments and certification enquiries.

• Drata

  Primary administrator. You’ll own framework configuration and control mapping, maintain integration health across AWS, Microsoft Entra , Intune, Git Hub, Rippling, and connected systems. Automated evidence collection sits with individual control owners; you monitor for gaps or failures and keep owners accountable, keeping Drata and the ISMS manual consistent.

• Governance & Risk

  Chair the Governance, Risk and Compliance Committee, owning the agenda and policy review cycle. Maintain the company risk register in Drata and report audit status, risk exposure, and control effectiveness to leadership and the board.

• Policy & Documentation

  Own the policy register in Drata, ensuring policies stay current and accurate, updating them in response to regulatory changes or operational changes, and advising leadership on required updates.

• Vendor & Third‑Party Risk

  Conduct and support structured vendor risk assessments, review SOC 2 reports, ISO certificates, and DPAs, maintain the vendor register, and ensure periodic reviews are completed on schedule.

• Infrastructure & Evidence

  Navigate AWS, Microsoft Entra , Intune, and Git Hub to pull evidence with little to no developer assistance. Use AI tools to accelerate evidence gathering, policy drafting, and control assessments. Support access management and joiner/mover/leaver processes from a governance perspective.

• Training, Culture & Regulatory

  Administer cybersecurity awareness training via Rippling LMS and track completion against framework requirements. Support compliance across Energy Sys’s three legal entities (UK, Australia, US), including GDPR and relevant data protection obligations. Embed a culture where compliance is practical, proportionate, and understood across the organisation.

• Hands‑on SOC 2 and/or ISO 27001 experience: evidence management, direct auditor engagement.
• GRC platform experience (Drata, Vanta, or similar).
• Cloud literacy: comfortable navigating AWS and Microsoft Entra , or actively willing to learn.
• Strong written communication: policies, risk registers, committee papers & minutes.
• Self‑directed and ownership‑minded, able to run a compliance programme independently.
• AI‑…