Compass Education

Security Engineer

• Lead Compass's risk, compliance and information security functions
• Own certification and audit programmes, including ISO 27001 and PCI DSS
• Maintain the ISMS and manage certification audits and corrective actions
• Scope and maintain PCI DSS compliance for payment processing
• Manage obligations under the Australian Privacy Principles and equivalent UK and Irish regimes
• Conduct privacy impact assessments and privacy-by-design sign-off
• Handle privacy complaints
• Manage information governance, including data classification, retention, disposal and records management
• Own the security and information policy suite with technical input from technology leaders
• Manage regulatory breach notifications and compliance clauses in customer and government contracts
• Respond to customer and government due diligence questionnaires
• Maintain the compliance risk register
• Aggregate information security posture and risk into quarterly reports for the ELT and Board
• Ensure vendor contracts include appropriate data protection and security clauses
• Line manage Legal Counsel
• Oversee legal risk and contract review as part of the broader governance remit

Head of Risk, Compliance and Information Security