Compliance Analyst

Role purpose

Key responsibilities

• Maintain obligations and compliance risk registers, log changes, keep owners, controls, and review dates current, and follow up on actions.
• Monitor regulatory, legislative, and standards developments relevant to group markets and products; prepare summaries of sources, publication dates, likely impact, and questions for senior review.
• Maintain policy inventory and review calendar; coordinate reviews, approvals, version control, and publication.
• Maintain the AI system inventory and support AI use-case intake and approval administration.
• Maintain certification evidence, including ISO/IEC 27001 and Cyber Essentials, between audit cycles.
• Coordinate internal, surveillance, recertification, and assurance audits; collect evidence, arrange auditor logistics, record findings and responses, and track remediation.
• Draft customer and prospect security and compliance questionnaire, due diligence, and tender responses using approved content; maintain the approved answer library.
• Support supplier due diligence by issuing questionnaires, following up responses, recording outcomes, and flagging gaps.
• Produce compliance metrics, dashboards, and draft Board and committee reporting; check data for completeness and inconsistency.
• Administer training and awareness; maintain the reporting, review, and audit calendar; monitor the compliance inbox; prepare governance agendas, papers, minutes, and action logs.

Authority and accountability

• Coordinate with Legal, Company Secretariat, Information Security, IT, Risk, Procurement, HR, Finance, and business teams while maintaining clear divisions of responsibility.
• Manage routine work independently within agreed procedures and delegated authority once trained; escalate complex interpretations, significant risks, deadlines at risk, and sensitive external correspondence.
• This is a second-line role supporting control design, monitoring, and evidence. Business owners remain responsible for operating first-line controls and authorized risk decisions.
• Research, draft advice, reporting, and external correspondence are reviewed before issue; senior designated roles retain decisions on legal interpretation, risk acceptance, regulatory notification, and certification scope.

Essential experience

• Two to four years’ experience in compliance, risk, governance, assurance, audit, or an analyst or coordination role with substantial regulatory, certification, or reporting content.
• Experience maintaining registers, trackers, or evidence libraries accurately and following through on multiple commitments against competing deadlines.
• Strong data handling and Excel skills, including lookups, pivot tables, reconciling data, and turning raw data into accurate metrics, charts, and reporting.
• Clear written English for concise summaries, professional correspondence, accurate minutes, and draft papers needing little rework.
• Sound research skills: locate credible sources, verify currency and relevance, separate fact from interpretation, and flag uncertainty.
• Careful handling of confidential and commercially sensitive information, attention to detail, good judgment, and comfort escalating when needed.
• Comfort working in a small function where work is broad and priorities change.

Desirable experience

• Exposure to ISO/IEC 27001, Cyber Essentials, or SOC 2 evidence collection, or to surveillance and recertification audit cycles.