Compliance & Information Governance Lead

11 Investments; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

11 Investments is seeking a Compliance & Information Governance Lead to own the company’s information governance, data protection and compliance programs. The role requires pragmatic, hands-on leadership across GDPR, privacy, information security and risk management, with broad interaction from Product and Engineering to senior leadership.

You will drive DPIAs/DPAs/ROPA, vendor due diligence, and incident response while aligning with ISO standards and DSP Toolkit.

Qualifications

• Strong hands-on GDPR and UK data protection experience, including DPIAs, DPAs, ROPA and data subject requests.
• Practical information security experience and ability to assess regulatory requirements and convert them into pragmatic guidance.
• Experience running compliance frameworks and audits (ISO 27001, ISO 9001, ISO 14001, DSP Toolkit or Cyber Essentials Plus).

Responsibilities

• Own information governance and data protection framework.
• Provide GDPR advice and manage DPIAs, DPAs, ROPA and privacy policies.
• Manage information security controls and vulnerability management.
• Lead ISO 27001, ISO 9001, ISO 14001 certifications and audits.
• Support DSP Toolkit compliance and audits.
• Oversee supplier due diligence and subprocessor reviews.
• Lead security and information governance incident response.
• Review data protection clauses in client and supplier contracts.
• Assist tenders, implementations and contract drafting.
• Deliver information security and compliance training.
• Advise exec team on data usage and AI.
• Coordinate with Clinical Safety Officer on medical device capabilities.

Skills

GDPR & Data Protection

Information Governance

Information Security

Regulatory Compliance

Risk Assessment

Vendor Due Diligence

Contract Negotiation

Incident Response

Privacy Policies

AI Data Usage

Tools

DSP Toolkit

ISO 27001

ISO 9001

ISO 14001

Cyber Essentials Plus

Job description

Compliance & Information Governance Lead | HealthTech

Salary based on experience

Remote first/London

We are working with a fast-growing healthtech business looking for a pragmatic, hands-on Compliance & Information Governance Lead to take ownership of its information governance, data protection and compliance function.

This is a broad role with genuine ownership. They need someone who can understand what regulation says, assess the real risk and turn that into practical recommendations that allow the business to keep moving at pace.

You’ll work across Product, Engineering and the wider business, through to senior leadership, becoming the go-to person for compliance, IG, privacy and information security.

What you’ll be doing:

• Owning the information governance and data protection framework
• Providing GDPR advice and managing DPIAs, DPAs, ROPA and privacy policies
• Managing information security controls, including vulnerability management
• Leading ISO 27001, ISO 9001 and ISO 14001 certifications and ongoing compliance
• Supporting DSP Toolkit compliance and audits
• Managing supplier and subprocessor due diligence
• Leading security and IG incident response
• Reviewing data protection, privacy and security elements of commercial contracts
• Supporting client teams with tenders, implementations and contract drafting
• Delivering information security and compliance training
• Advising the exec team on the use of data and AI
• Working alongside the Clinical Safety Officer as the business develops its medical device capabilities

What they’re looking for:

You’ll have strong hands-on GDPR and UK data protection experience, including DPIAs, DPAs, ROPA and data subject requests, alongside practical information security experience.

You’ll also have experience running compliance frameworks and audits such as ISO 27001, ISO 9001, ISO 14001, DSP Toolkit or Cyber Essentials Plus.

Experience working within a technology business is important. They want someone who can confidently challenge senior stakeholders, understand risk and turn regulation into pragmatic, commercially sensible advice.

You’ll also need enough contractual knowledge to negotiate data protection, privacy and security clauses in client and supplier agreements, but you do not need to be a qualified lawyer.

Healthtech, healthcare or NHS experience would be a bonus, as would exposure to clinical safety, medical device regulation, ISO 13485 or advising on AI and new uses of data.

The business is remote by default, with a London office available for collaboration.