Technical Policy & Compliance Manager

Nextech Group Limited; Tees Valley; On-site; GBP 30,000 - 35,000; Full time

Job summary

Nextech Group Limited in Middlesbrough is seeking a Policy & Compliance Manager to own the Policy & Compliance function within the Technical Department.

You will lead Cyber Essentials, GDPR, and compliance tooling, and develop revenue-generating service offerings for clients, alongside penetration testing. You must be comfortable leading client meetings from day one.

Qualifications

• Strong technical grounding with cyber and compliance exposure.
• Know GDPR/ICO compliance and DPA basics.
• Experience writing and implementing company policy and business continuity.
• Ability to lead internal and client meetings with confidence.

Responsibilities

• Own Cyber Essentials internally and for clients; manage certification cycles.
• Own GDPR roadmap; close gaps; ensure data handling compliance.
• Administer Kaseya Compliance Manager or similar platform.
• Lead and coordinate pen testing engagements as a new offering.
• Develop policy controls, change management, and training programs.
• Provide occasional Service Desk support when needed.

Skills

Technical background

Cyber Essentials

GDPR knowledge

DPA knowledge

Policy drafting

Project management

Communication

Pen testing exposure

Client leadership

Security product mindset

Education

CCEP certification

Tools

Kaseya Compliance Manager

GRC tooling

Job description

Job Title - Policy & Compliance Manager

Department - Technical

Reports to - Head of Technical

Location - Middlesbrough

Salary - £30,000 - £35,000

Contract - Permanent, full time

The role -

We are looking for someone to take ownership of our Policy & Compliance function and lead it. You'll sit in the Technical Department, alongside Service Desk, Networks, Projects and Infrastructure, reporting into the Head of Technical.

The job blends hands‑on technical credibility with compliance leadership. You'll hold our Cyber Essentials and GDPR positions internally, and build both into priced, revenue‑generating service offerings for our client base, alongside penetration testing. You'll need to be comfortable standing by your decisions, confident in front of clients as well as colleagues, and happy to roll your sleeves up on technical work when the Desk needs a hand.

What you'll own -

Five areas of responsibility, each one yours to run rather than assist with.

Cyber Essentials - Internal and client-facing

• Project manage Cyber Essentials and Cyber Essentials Plus certification, for us and for clients
• Own scoping, evidence gathering, remediation planning, submission and renewal cycles
• Build it into a structured, priced product offering

GDPR and data protection - Including DPO services

• Own the GDPR roadmap: define milestones, close gaps, keep us compliant
• Apply ICO knowledge practically across registration, breach reporting, DSARs and records of processing activity
• Write customer data policies, IT acceptable use policies and IT business continuity plans
• Act as Data Protection Officer for clients who buy the service

Compliance tooling - Within our Kaseya stack

• Own and administer Kaseya Compliance Manager, or an equivalent platform
• Use it to evidence and report on compliance posture, for us and for clients

Penetration testing - A new commercial line

• Lead and coordinate pen testing engagements, internally and for clients
• Build it into a commercial offering alongside Cyber Essentials

Policy and internal controls - The underlying discipline

• Apply change management when drafting and revising policy
• Create and maintain sound internal controls, and monitor adherence to them
• Audit policy, practices and documents proactively to find weaknesses before anyone else does
• Train and educate employees and clients, and field their compliance questions

Service desk support - Occasional, not your day job

• Flex into Service Desk support when it's needed
• Keep enough technical grounding, and enough understanding of desk SLAs, to help efficiently without being a primary desk resource

One thing to be clear about

This is not a developmental role with extensive training and a long runway. We need someone who can pick it up and run with it from day one.

That means you already have the technical grounding and the compliance exposure to take ownership quickly, and you're comfortable operating with minimal supervision. If that's you, you'll have a function to shape and real commercial ownership of it.

What you'll need

• A strong technical background, ready to step up
• Demonstrable experience with Cyber Essentials and Cyber Essentials Plus certification
• Knowledge of GDPR, ICO compliance and general compliance controls such as the DPA
• Experience with Kaseya Compliance Manager or a similar GRC tool
• Pen testing exposure, whether scoping, coordinating or delivering
• Experience writing and implementing company policy, plus business continuity work
• The confidence to lead internal and customer meetings
• Project management skills, and the drive to take an initiative to completion on your own
• A commercial mindset that treats compliance and security as a product, not a cost centre
• Excellent communication, integrity, professional ethics and close attention to detail

Nice to have

• MSP experience
• Time spent in a compliance environment, full or part time
• Health or education sector experience
• General cyber security experience
• Professional certification such as CCEP. We'll support the right candidate through certification

Technical skills we'll expect

• Windows Server administration: AD, Group Policy, DNS and DHCP
• Microsoft 365 and Azure AD administration
• Networking fundamentals: VLANs, firewalls, routing and switching
• Backup and disaster recovery concepts
• RMM and PSA tooling, ideally the Kaseya stack
• Troubleshooting across desktop, server and network estates