fresha - Head of Compliance

• ## What you'll own • Audits and certifications • Run the PCI DSS audit to completion, then GDPR and SOC 2 Type II this year • Be the main point of contact for external auditors — scoping, evidence, walkthroughs, findings • Keep HIPAA and ISO 27001 in good shape between recertifications • Compliance operations • Quarterly access reviews across in-scope systems • Sprinto: make sure controls are covered, failures are triaged quickly, and evidence is current • Vulnerability management: track closure against agreed SLAs and chase what's drifting • Own the compliance risk register — keep it current, get it reviewed on a regular cadence, and make sure it actually informs decisions rather than just sitting there for auditors • Data protection • Handle Subject Access Requests and Data Access Requests end-to-end • Keep the GDPR ROPA accurate as systems, vendors, and data flows change • Own and enforce data retention — not just on paper, but actually in the systems • Vendor and third-party risk • Review new vendors before they're onboarded — security posture, data handling, DPAs • Reassess critical and high-risk vendors on a regular cycle • Keep the vendor inventory, DPAs, and sub-processor lists tidy and audit-ready • Policy and awareness • Write new policies and update existing ones as our environment, regulations, and business change • Make sure policies are usable, understood, and actually followed — not shelfware • Own the compliance and privacy training programme: annual training, role-specific training for engineers handling PHI or cardholder data, and whatever else our frameworks demand • Automation and AI • Look at every recurring task in this role and ask "why is a human still doing this?" —evidence collection, control testing, access review workflows, vendor questionnaire triage, SAR data discovery, policy drafting, ROPA upkeep • Push Sprinto and our adjacent tooling as far as they'll go, and fill the gaps with scripts, workflows, or AI where it makes sense • Use LLMs sensibly for drafting, review, and first-pass analysis — but know where a human still has to sign off, especially anything that goes to a regulator or an auditor • Treat the function's operating model as a product: fewer manual rituals each quarter, not more • You've led compliance through at least a couple of these frameworks (PCI DSS, SOC 2, ISO27001, HIPAA, GDPR). You don't need all of them, but PCI DSS and GDPR experience would be very valuable right now • You've dealt directly with auditors and you're comfortable pushing back when scoping or findings are off • You're hands-on. This is not a role where you delegate everything and review slides — you'll be in Sprinto, in tickets, in policy drafts, and in vendor reviews • You're fluent with AI tools and comfortable building automation — whether that's Sprinto workflows, scripting against APIs, using LLMs to cut down manual work, or knowing when to bring in an engineer to build something properly. You don't need to be a developer, but "I'll wait for someone to build it for me" isn't the right mindset • You can translate between engineers and auditors without frustrating either side • Bonus: experience with GRC tooling beyond Sprinto, DPO or DPO-adjacent work, payments regulatory exposure, or a track record of measurably reducing manual compliance work through automation • ## How you'll work • You'll have one direct report from day one, and the remainder to grow the function as the workload justifies. You'll work closely with Security, IT, Legal, Engineering and People. Expect to spend real time with auditors during audit windows and real time with engineering and vendor teams the rest of the year. • ## Interview Process • Screen Stage - Video-call with a member from the Talent Team (45-60min) • 1st Stage - Interview with the VP of Security, IT & Compliance (60min) • Final Stage - Video interview with CTO (60min) and Head of Talent (30min) • We aim to finalise the entire interview process and deliver feedback within 4 weeks. • Every job application received is reviewed manually by our talent team. While we strive to assess applications within 7 days, the sheer volume of talented individuals expressing interest may occasionally extend this timeframe • Inclusive workforce • At Fresha, we are creating a culture where individuals of all backgrounds feel comfortable. • We want all Fresha people to feel included and truly empowered to contribute fully to our vision and goals. Everyone who applies will receive fair consideration for employment. • We do not discriminate based on race, colour, religion, sex, sexual orientation, age, marital status, gender identity, national origin, disability, or any other applicable legally protected characteristics in the location in which the candidate is applying. • If you have any accessibility requirements that would make you more comfortable during the interview process and/or once you join, please let us know so that we can support you.