Compliance & Information Governance Lead

Compliance & Information Governance Lead | Health Tech

Salary based on experience

Remote first/London

We are working with a fast-growing healthtech business looking for a pragmatic, hands-on Compliance & Information Governance Lead to take ownership of its information governance, data protection and compliance function.

This is a broad role with genuine ownership. They need someone who can understand what regulation says, assess the real risk and turn that into practical recommendations that allow the business to keep moving at pace.

You’ll work across Product, Engineering and the wider business, through to senior leadership, becoming the go-to person for compliance, IG, privacy and information security.

What you’ll be doing:

• Owning the information governance and data protection framework
• Providing GDPR advice and managing DPIAs, DPAs, ROPA and privacy policies
• Managing information security controls, including vulnerability management
• Leading ISO 27001, ISO 9001 and ISO 14001 certifications and ongoing compliance
• Supporting DSP Toolkit compliance and audits
• Managing supplier and subprocessor due diligence
• Leading security and IG incident response
• Reviewing data protection, privacy and security elements of commercial contracts
• Supporting client teams with tenders, implementations and contract drafting
• Delivering information security and compliance training
• Advising the exec team on the use of data and AI
• Working alongside the Clinical Safety Officer as the business develops its medical device capabilities

What they’re looking for:

You’ll have strong hands-on GDPR and UK data protection experience, including DPIAs, DPAs, ROPA and data subject requests, alongside practical information security experience.

You’ll also have experience running compliance frameworks and audits such as ISO 27001, ISO 9001, ISO 14001, DSP Toolkit or Cyber Essentials Plus.

Experience working within a technology business is important. They want someone who can confidently challenge senior stakeholders, understand risk and turn regulation into pragmatic, commercially sensible advice.

You’ll also need enough contractual knowledge to negotiate data protection, privacy and security clauses in client and supplier agreements, but you do not need to be a qualified lawyer.

Healthtech, healthcare or NHS experience would be a bonus, as would exposure to clinical safety, medical device regulation, ISO 13485 or advising on AI and new uses of data.

The business is remote by default, with a London office available for collaboration.