Compliance Analyst

Role Purpose

Support the Group Head of Compliance in running the group’s compliance framework day to day. Maintain the registers, evidence and management information that demonstrate the group meets its legal, regulatory, contractual and certification obligations, and provide the coordination and reporting that keep the compliance programme on schedule. The role combines compliance administration with the data and reporting work that turns compliance activity into management information for senior management and the Board. It is the first appointment into the function alongside the Group Head of Compliance, so it carries unusual breadth for its level and is a direct route into specialisation as the function grows.

Key Responsibilities

• Maintain the obligations register and the compliance risk register. Log new and changed obligations, keep owners, controls and review dates current, and follow up action owners.

• Monitor regulatory, legislative and standards developments relevant to the group’s markets and products. Prepare short summaries setting out the source, publication date, likely impact and questions for senior review.

• Maintain the policy inventory and review calendar, and coordinate policy reviews, approvals, version control and publication to the business. Maintain the AI system inventory and support the administration of the AI use-case intake and approval process.

• Maintain the evidence library behind the certification portfolio, including ISO/IEC 27001 and Cyber Essentials, so that evidence stays current between audit cycles rather than being assembled under pressure.

• Support internal audits, surveillance and recertification audits and assurance reviews. Coordinate scheduling, evidence collection and auditor logistics, record findings and management responses, and track remediation actions to closure.

• Draft responses to customer and prospect security and compliance questionnaires, due diligence requests and tenders using approved content, and maintain the approved answer library so that responses stay consistent and current.

• Support commercial and regulatory supplier due diligence. Issue questionnaires, follow up responses, record outcomes and flag gaps for review.

• Produce compliance management information, including metrics, dashboards and draft Board and committee reporting packs. Check data for completeness and inconsistency before anything is issued.

• Administer compliance training and awareness activity, maintain the function’s calendar of reporting, reviews and audits, monitor the compliance inbox, and prepare agendas, papers, minutes and action logs for governance forums.

Authority & Accountability

Work closely with Legal, Company Secretariat, Information Security, IT, Risk, Procurement, HR, Finance and business teams, coordinating with neighbouring governance functions on overlapping matters and maintaining a clear division of responsibilities. Manage routine work independently within agreed procedures and delegated authority once trained. Escalate complex interpretations, significant risks, deadlines at risk and sensitive external correspondence to the Group Head of Compliance.

This is a second-line role supporting the design, monitoring and evidencing of controls; business owners remain accountable for operating first-line controls and for authorised risk decisions. Research findings, draft advice, reporting and external correspondence are reviewed before issue. Decisions on legal interpretation, risk acceptance, regulatory notification and certification scope rest with the Group Head of Compliance, the Group General Counsel and other designated senior roles.

Essential Experience

• Two to four years’ experience in a compliance, risk, governance, assurance or audit role, or in an analyst or coordination role with substantial regulatory, certification or reporting content.

• A track record of maintaining registers, trackers or evidence libraries accurately over time, and of following through on multiple commitments against competing deadlines without prompting.

• Strong data handling. Confident in Excel, including lookups, pivot tables and reconciling data from different sources, and able to turn raw data into accurate metrics, charts and reporting.

• Clear written English: concise summaries, professional correspondence, accurate minutes and draft papers that need little rework.

• Sound research skills - locating credible sources, confirming currency and relevance, separating fact from interpretation, and flagging what remains uncertain.

• Careful handling of confidential and commercially sensitive information, strong attention to detail, and good judgement about when to ask and when to escalate. Comfortable working in a small function where the work is broad and priorities change.

Desirable Experience

• Exposure to ISO/IEC 27001, Cyber Essentials or SOC 2 evidence collection, or to surveillance and recertification audit cycles.

• Experience drafting security and compliance questionnaire, due diligence and tender responses, and maintaining an approved answer library.

• Familiarity with governance, risk and compliance or audit tooling, and with dashboarding tools such as Power BI or Looker Studio.

• AI governance exposure - the EU AI Act, ISO/IEC 42001, or model and system inventories.

• Study or training in law, business, risk, information management or a related subject, or equivalent demonstrable experience. A professional certificate such as the ICA or IRM is welcome but not required.

• Experience in a technology, platform or high-growth environment.

The compliance function is being built out. As specialist roles are appointed, this role is the natural route into one of them or into a Compliance Manager position, and support is available for relevant professional study.