Head of Risk, Compliance and Information Security

About the role

Lead Compass Education’s risk, compliance and information security function as the business scales globally. You will own certification programmes, regulatory compliance across multiple jurisdictions, and report security posture to senior leadership and the Board.

Key responsibilities

• Maintain ISO 27001 ISMS, manage certification audits and corrective actions.
• Scope and sustain PCI DSS compliance for payment processing.
• Oversee privacy obligations under Australian Privacy Principles, UK and Irish regimes, conduct privacy impact assessments and handle complaints.
• Define data classification, retention, disposal and records management policies.
• Develop and own the security and information policy framework with input from technical leaders.
• Prepare regulatory breach notifications, contract compliance clauses and respond to due‑diligence questionnaires.
• Maintain a compliance risk register and produce quarterly risk reports for the ELT and Board.
• Ensure third‑party contracts include appropriate data protection and security clauses.

Required profile

• 6+ years leading compliance, risk or information security in SaaS, fintech or regulated technology environments.
• Hands‑on experience delivering end‑to‑end PCI DSS compliance.
• Proven track record managing ISO 27001 certification and an ISMS.
• Multi‑jurisdictional compliance experience, including AU Privacy Act and GDPR.
• Experience presenting risk and compliance posture to Board or Audit & Risk committees.

Required skills

• ISO 27001
• PCI DSS
• Australian Privacy Principles
• GDPR
• Risk register management
• Policy framework development
• Cloud compliance (GCP)

What we offer

• Hybrid working environment with office hubs.
• Learning and development budget.
• 24/7 Employee Assistance Program.
• Parental leave for primary and secondary carers.
• Regular team events, social budget and in‑office perks.
• Employee Referral Program.
• Inclusive, equal‑opportunity culture.