Compliance (GRC) Engineer (London)

About Fresha

Fresha is the leading AI-powered operating system for the global beauty and wellness industry, giving businesses everything they need to run smarter, grow faster and build stronger client relationships.

In May 2026, Fresha secured an $80M growth investment from KKR at a valuation of $1B , officially reaching unicorn status and bringing total funding raised to $285M. Already profitable, Fresha is using this investment to accelerate global expansion and drive the next generation of AI and product innovation.

Today, Fresha operates at global scale, with offices across Europe, North America, the Middle East and Asia Pacific. Our platform is trusted by 130,000+ beauty and wellness businesses across 120 countries , with more than 1.5 billion appointments booked to date.

Our mission is simple: help beauty and wellness businesses grow by giving them the technology they need to attract clients, manage their operations and run their business in one place.

We’re continuing to scale rapidly across markets, teams and products, making this an exciting time to join us.

Role Overview

Compliance (GRC) Engineer | The Bower, 207-211, Old St, Tower, London EC1V 9NR | Four days a week in office

You'll join the Compliance team and report to the Head of Compliance. We want an engineer first, not a compliance expert: someone who understands regulation and builds systems that prove compliance continuously and automatically. You'll work closely with Security, Platform, IT and product engineering teams.

This is our first GRC Engineer hire. We run GDPR, HIPAA, ISO 27001 and the UK NIS Regulations, and we're building PCI DSS Level 1 right now. SOC 2 Type II and the EU AI Act come next. Much evidence is still collected by hand. Your job is to make compliance run on code, so we're audit-ready every day, not just in audit season. Compliance should keep pace with business and engineering, never slow it down.

AI is standard here. You get Claude, Codex or Cursor from day one. Use them to move fast, and own every output before it counts as audit evidence.

What You'll Do

• Automate evidence: Build integrations that pull control evidence from cloud, identity, endpoint, CI/CD and HR systems into Sprinto, our compliance platform.

• Monitor controls continuously: Write checks that catch drift in access, encryption, logging, patching and change approval, and alert the owner.

• Ship compliance as code: Put guardrails in pipelines and infrastructure as code so non-compliant changes fail before production.

• Map once, comply many: Run one control set mapped to PCI DSS, ISO 27001, HIPAA, SOC 2, GDPR and NIS2.

• Own the platform: Keep Sprinto clean as the system of record. Fix broken integrations, controls and ownership.

• Build PCI DSS Level 1: We're building the programme now. Bake automation into controls, scope, cardholder data flows and network diagrams from day one, generated from source where possible.

• Make audits boring: Give auditors repeatable, automated evidence and lead technical walkthroughs.

• Work with engineering teams: Turn findings from Security, Platform and IT into fixes engineers can ship, as PRs and tickets.

• Report: Dashboards on control health, evidence freshness and audit readiness for leadership.

• Shape AI governance: Help build AI controls as the EU AI Act lands.

Our compliance stack: Sprinto as the system of record for controls, evidence and training. In scope today: GDPR, HIPAA, ISO 27001 and the UK NIS Regulations. In build now: PCI DSS Level 1. Next: SOC 2 and the EU AI Act.

What you'll automate against: Services in Ruby, Elixir and TypeScript, with Kafka, Postgres and Kubernetes, shipping around 3,000 deploys a week.

What We're Looking For

• Experience: 3+ years as a software, platform, cloud, SRE or security engineer. Compliance automation experience is a strong plus.

• Code: Strong in Python, Go or similar. You've built and run production services and integrations, not just scripts.

• Cloud: Hands-on experience (AWS preferred): IAM, logging, and infrastructure as code such as Terraform.

• Frameworks: Familiar with at least one of PCI DSS, ISO 27001, SOC 2 or HIPAA. You don't need to be an expert, but you know what a control must prove.

• Compliance platforms: Experience with Sprinto, Vanta, Drata or similar, and their integrations.

• Delivery: CI/CD and git-based workflows (for example GitHub Actions).

• Evidence you can defend: You think about what happens when an integration silently stops or a check passes on the wrong data. You design for it rather than finding out at audit.

• AI in your workflow: You use AI tools day to day, know where they help and where they don't, and review what comes back before it ships.

• Clear writing: You can explain a control to an engineer and a risk to an exec.

• Ownership: You'll shape how a lean team works, not follow a playbook.

• Bonus: PCI DSS Level 1, payments or fintech experience; SIEM, FIM or CSPM tooling; GDPR, NIS2 or EU AI Act knowledge; certifications such as CISSP, CISA, CCSP, ISO 27001 Lead Auditor or AWS Certified Security - Specialty.

At Fresha, we value passion and potential as much as specific skills. If you're enthusiastic and eager to learn, we encourage you to apply, even if you don't meet every listed requirement.

Your Opportunity at Fresha

• Scale: Around 1 million bookings a day across 120 countries, and the payments that go with them. Compliance here protects real money and real customer data.

• Ownership: You're our first GRC Engineer, joining while we build PCI DSS Level 1. You pick the tooling, patterns and roadmap for compliance automation.

• Breadth: Four frameworks live, PCI DSS Level 1 in build, SOC 2 and the EU AI Act next. One control set, many audits.

• Speed: Around 3,000 deploys a week. Compliance has to keep pace, not slow it down.

Interview Process

• Screen Stage - Video call with a member of the Talent Team (30min)

• 1st Stage - Video interview with the Head of Compliance (45-60min)

• 2nd Stage - Live technical session: automate evidence for one real-world control (60-90min)

• Final Stage - Video interview with VP of Security & Compliance / CTO (45-60min)

Inclusive workforce

At Fresha, we are creating a culture where individuals of all backgrounds feel comfortable.

We want all Fresha people to feel included and truly empowered to contribute fully to our vision and goals. Everyone who applies will receive fair consideration for employment.

We do not discriminate based on race, colour, religion, sex, sexual orientation, age, marital status, gender identity, national origin, disability, or any other applicable legally protected characteristics in the location in which the candidate is applying.

If you have any accessibility requirements that would make you more comfortable during the interview process and/or once you join, please let us know so that we can support you.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us