Head of Risk, Compliance and Information Security

Compass-Education; Sydney; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work

PD budget

EAP

Parental leave

Team events

Referral program

Inclusive culture

Job summary

Compass is seeking a Head of Risk, Compliance and Information Security to lead the company’s risk and compliance programme across multiple jurisdictions. You will own the ISMS, PCI DSS scope, privacy obligations and governance framework, reporting posture to the ELT and Board.

You’ll partner with technical leaders to translate complex regulatory and security requirements into practical, scalable controls, policies and decision-making in a fast-moving EdTech environment.

Qualifications

• 6+ years in compliance, risk or information security leadership.
• Experience owning PCI DSS compliance end to end.
• Multi jurisdictional compliance including AU Privacy Act and GDPR.
• Translating regulatory/technical requirements into actionable items.

Responsibilities

• Maintain ISMS and certifications for ISO 27001 and equivalents.
• Scope and maintain PCI DSS for payment processing.
• Oversee privacy and data protection obligations across jurisdictions.
• Manage information governance, classifications, retention and records management.
• Own the security policy suite with technical collaborators.
• Lead regulatory reporting and response to due diligence.
• Summarize risk posture for ELT and Board quarterly.
• Ensure vendor contracts include data protection and security clauses.

Skills

Compliance leadership

Risk management

Information security

ISO 27001

PCI DSS

Privacy by design

Regulatory reporting

Stakeholder comms

Policy design

Cross-functional leadership

Education

ICA

CIPP

CISSP

CISM

Tools

GCP

Job description

Come shape the future of education with us.

At Compass, we're on a mission to transform the school day for everyone - from staff and students to families and administrators. We build smart, seamless technology that empowers schools to focus on what really matters: learning, growing and thriving.

That mission has fuelled our growth into a global scale-up, now supporting 5,000+ schools across three countries, backed by a team of 300+ people. Our all-in-one school management platform is redefining how education communities connect, communicate and operate.

We’re now looking for a Head of Risk, Compliance and Information Security to lead how Compass manages risk, compliance and information security as our business continues to evolve.

About the Role

You’ll take ownership of our certification and audit programmes, including ISO 27001 and PCI DSS, our approach to multi-jurisdictional regulatory compliance, information governance, and our security and information policy framework. You’ll be our designated point of accountability for reporting information security and compliance posture to the ELT and Board.

Working closely with our technical leaders, you’ll bring together the regulatory, risk and security picture across the business, translating complexity into clear priorities, practical frameworks and confident decision-making.

This is a genuine opportunity to build and shape how Compass approaches risk, compliance and information security, creating a framework that supports the business while keeping pace with its evolving technology, regulatory and commercial environment.

What you’ll own

• Certifications and standards: maintain the ISMS, and manage certification audits and corrective actions for ISO 27001 and equivalent standards.
• Payment security compliance: scope and maintain PCI DSS compliance for any payment processing.
• Privacy and data protection: obligations under the Australian Privacy Principles and equivalent UK and Irish regimes, privacy impact assessments, privacy by design sign off, and handling of privacy complaints.
• Information governance: data classification, retention and disposal, and records management.
• Policy framework: own the overarching security and information policy suite, drawing on technical input from Director AI & Security and Head of Technology.
• Regulatory and contractual reporting: regulatory breach notification, compliance clauses in customer and government contracts, and responses to customer and government due diligence questionnaires.
• Information security risk and governance reporting: maintain the compliance risk register, and aggregate information security posture and risk into a quarterly report to the ELT and Board.
• Third party contractual compliance: ensure vendor contracts carry appropriate data protection and security clauses, paired with technical review from the Head of Technology.

About You

You are an experienced compliance, risk or information security leader who enjoys operating at the intersection of risk, regulation, technology and commercial decision-making. You can build robust frameworks without creating unnecessary complexity, and are comfortable taking ownership of a broad mandate in a fast-moving environment.

You will bring:

• 6+ years in compliance, risk or information security leadership, ideally in a SaaS, fintech or regulated technology environment, with experience owning PCI DSS compliance end to end.
• Hands on ISO 27001 experience, having led a certification or maintained an ISMS end to end, not just assessed against the framework.
• Multi jurisdictional compliance experience, including practical application of the AU Privacy Act and GDPR.
• Practical knowledge of a recognised security framework and how to translate it into requirements a technical team can implement, without necessarily running that team directly.
• Experience presenting risk and compliance posture to a Board or Audit & Risk Committee.
• A builder's mindset, comfortable designing frameworks and policies from scratch that a fast moving business can actually follow.
• Strong stakeholder communication skills, able to translate regulatory and technical complexity into clear, commercial language, and to work as a peer with technical leaders rather than as their manager.

Highly regarded:

• Experience in payments, acquiring or merchant services environments, and familiarity with PayTo, NPP or Open Banking compliance.
• Experience in a scaling SaaS, EdTech or fintech business.
• Relevant qualifications such as ICA, CIPP, CISSP, CISM or equivalent.
• Exposure to GCP or cloud first infrastructure compliance.

Why Compass

You'll join a purpose-driven company at a genuinely exciting stage scaling product, team, and markets simultaneously. This is a rare opportunity to build something from scratch and leave a real mark on how a high-growth EdTech business operates safely and responsibly.

What we offer

• A hybrid working environment, with teams working a hybrid structure at our office hubs.
• Learning and development opportunities, including a dedicated PD budget.
• 24/7 access to our Employee Assistance Program (EAP), including face-to-face, phone and live chat support.
• A parental leave program for both primary and secondary carers.
• Regular team events, social budgets and in-office perks help you stay connected, from team lunches to end-of-week socials.
• Employee Referral Program
• A supportive, inclusive culture where your voice is valued and heard.

Ready to build something that matters?

Compass is proud to be an equal opportunity employer. We embrace and celebrate diversity and are committed to creating an inclusive environment for all employees.

Prior to commencing employment, you’ll need:

• A valid Employee Working With Children Check
• A satisfactory National Police Check
• Verification of unrestricted work rights in Australia (e.g. citizenship, passport or birth certificate)