Quality & Regulatory Affairs Manager

Heim; Greater London; Hybrid; GBP 60,000 - 80,000; Full time

Benefits offered by this job

Equity options

33 days holiday (plus birthday)

Hybrid work from Shoreditch

Direct ownership of QA/regulatory

Job summary

Heim is hiring its first Quality & Regulatory Affairs Manager to own how our software products are built safely and compliantly. You will lead the QMS, regulatory submissions, and information governance to enable rapid, trusted deployments.

You’ll work with our founders and clinical leadership to scale MDR readiness, UKCA registrations, and post-market activities while fostering a startup-friendly, AI-enabled compliance culture.

Qualifications

• SaMD experience in regulatory affairs for software as a medical device.
• Experience running a full ISO 13485 quality management system end to end.
• Experience designing or running post-market surveillance and validation studies.
• Solid knowledge of UK GDPR, DPIAs, ISO 27001, and comfortable acting as DPO.

Responsibilities

• Define regulatory strategy for MDR filings and product classifications.
• Own ISO 13485 QMS and risk management (ISO 14971).
• Oversee software lifecycle and usability standards (IEC 62304/IEC 62366).
• Develop technical documentation for Class I and II devices, including CEP/CER, risk files, and software life cycle docs.
• Lead UKCA registration for Class II and post-market surveillance.
• Set up AI feature change control to maintain regulatory position.
• Advise on regulatory routes for new markets (e.g., US).
• Act as Heim's Data Protection Officer and manage governance submissions (DTAC, DSPT).
• Maintain ISO 27001 certification and lead audits.

Skills

SaMD experience

QMS owner

Post-market proven

Governance fluent

Pragmatic

AI fluent

Calm and meticulous

Job description

Who We Are

At Heim, we are reinventing how healthcare is accessed, and creating technology to make home the default place for care.

We believe that healthcare is best delivered in the home of patients, and that we are at the cusp of a systemic shift away from hospital based care.

We are creating the AI Native Operating System to power community health. Heim On-demand gives access to on-demand community nursing services to people who need them, and Heim Software is the AI-native OS platform that lets community organisations run their own services with the same level of efficiency, intelligence, and ease that we use ourselves. This role indexes heavily towards Heim Software and is responsible for ensuring our technology is at the forefront of regulation for AISaMD and other relevant accreditations.

We are CQC registered and ISO 27001 accredited. We are already on our journey to class I MDR and aim to have this filed in the coming months. Our next step is MDR II.

The Role

We are hiring our first Quality & Regulatory Affairs Manager to own how Heim builds safe, compliant and trusted products. Heim Software is moving to UKCA Class I and then Class II as our AI capabilities grow from operational to increasingly clinical decision support and automation.

You will own our quality management system, our regulatory route to market, and the information governance every NHS partner needs before go-live. You will act as Heim's Quality Manager and Data Protection Officer. You will bring this work in-house from our current external support and build a function that lets us ship fast and stay safe.

You are accountable for three outcomes:

1. Market access on plan. Class I UKCA in place, then Class II, on a timeline the business can plan around.

2. Governance that never blocks a deal. DPIAs, DTAC, DSPT and ISO 27001 evidence ready for every trust, so governance speeds up go-live.

3. A quality system that keeps pace. An audit-ready QMS built for a fast-moving AI product, with post-market evidence that proves it is safe and performs.

What You'll Do

MDR Certification & Regulatory Delivery

• Define regulatory strategy for Heim’s upcoming MDR filings (Classification, intended use, claims)

• Act as Quality Manager: own and run our ISO 13485 quality management system

• Own risk management (ISO 14971), the software lifecycle (IEC 62304) and usability (IEC 62366) with Product and Engineering

• Own the development of the technical documentation for our upcoming Class I and Class II devices including:

  • Clinical Evaluation (CEP / CER)

  • Risk Management File (ISO 14971 aligned)

  • Software lifecycle documentation (as applicable)

• Own the UKCA registration and approved body process for Class II

• Design and run post-market surveillance and post-market validation studies, working with our clinical and data teams

• Set up change control for AI features, so model updates move quickly without breaking our regulatory position

• Advise on regulatory routes for new markets, including the US

Own information governance

• Act as Heim's Data Protection Officer, advising leadership independently on UK GDPR compliance

• Support DPIAs and data flow sign-off in commercial conversations and NHS go-lives, advising partners and our commercial team

• Own DTAC and DSPT submissions

• Maintain our ISO 27001 certification and lead recertification and surveillance audits

Clinical safety (desirable)

• Run the DCB0129 clinical safety process: hazard logs, safety cases and release sign-off, as Clinical Safety Officer if you hold the credentials

Build the function, with AI at the core

• Work in an AI-native manner to make quality and regulatory work faster: documentation, evidence, audit preparation

• Make compliance easy for the team, with clear processes that fit how a startup actually works. We need the team delivering on our regulatory requirements as part of our day to day and not seen as an afterthought. You’ll therefore need to build an everyday awareness of this into the culture and fabric of the team.

What We're Looking For

You have taken a software medical device to market and run its quality system. You are hands-on, pragmatic, and comfortable being the only expert in the room.

• SaMD experienced. 3 to 4 years in regulatory affairs for software as a medical device, ideally bringing a Class II device to market too

• QMS owner. You have run a full ISO 13485 quality management system end to end, not one area of it.

• Post-market proven. You have designed or run post-market surveillance and validation studies.

• Governance fluent. You know UK GDPR, DPIAs and ISO 27001 in practice, and you are comfortable acting as DPO.

• Pragmatic. You find the compliant route that lets the team move quickly, and you say no clearly when you need to.

• AI fluent. You use AI tools daily and understand the regulatory questions AI medical devices raise.

• Calm and meticulous. Priorities shift and the product evolves weekly. You bring order and an exceptional eye for detail.

Nice to have

• Clinical Safety Officer trained (DCB0129/0160). This requires current registration with a UK professional body (e.g. NMC, GMC, HCPC, GPhC) and a licence to practise.

• Experience with FDA regulatory pathways, including exemptions

• NHS experience: DTAC, DSPT, working with trust governance teams

Above all, you care about this. The shift of healthcare into the home is happening, and safe, trusted technology is what lets it scale.

.

Practical Requirements

• Right to work: You must have the right to work in the UK. We are not able to offer visa sponsorship for this role.

• Availability: We are looking for a start as soon as possible. Please tell us your availability in your application.

Why You Should Join Heim

• Solve real problems in healthcare: Help healthcare overcome the limitations of legacy technology.

• Give time back to the frontline: Be part of a mission that gives community teams a third of their time back. You will help reduce the 40% of the day that field staff currently spend on administrative tasks and manual workarounds.

• Deeply empathetic engineering: Build tools grounded in frontline reality. Our technology has been shaped by shadowing over 20,000 hours of community staff time.

• Address the issues that matter most: Work on software that directly targets the top concerns of frontline staff, including lone working safety, tiresome admin and repetitive tasks.

• Drive measurable impact: Deliver optimisation solutions that model a 42% average reduction in drive time and up to a 52% reduction in mileage for community teams.

• Build cutting-edge, secure technology: Develop AI that automates non-clinical touchpoints while working within a highly secure, ISO27001 UKAS accredited and DCB0129 compliant framework.

What We Offer

• Compensation: Salary of £[60,000 to 80,000] depending on experience, with eligibility for equity options at the end of your probation period and a performance-based bonus.

• Time off: 33 days' holiday (25 days plus 8 bank holidays), plus an extra day off for your birthday (or the nearest weekday).

• Direct ownership: Own quality and regulatory across the company, working directly with our founders and clinical leadership.

• Culture & connection: Enjoy regular socials, team trips, meals, and an annual company retreat.

• Flexibility that works: Hybrid working from our Shoreditch office.