duvo.ai

Compliance

• Own the Q&A library mapped to ISO 27001, SOC 2, ISO 42001, NIS2, and GDPR
• Govern ownership, approval status, evidence links, confidentiality classifications, and review dates for the Q&A library
• Maintain consistency across the Q&A library, trust center, Trust Center portal, policies, and engineering practices
• Manage customer security reviews from questionnaire intake through delivery
• Validate unverified answers with Security, Engineering, or Product
• Keep public trust-center and NDA-gated Trust portal document sets current
• Run the annual audit and certification programme, including SOC 2 Type II renewal, ISO 27001 and ISO 42001 surveillance, NIS2 assessment, penetration testing and retesting, and customer right-to-audit requests
• Gather evidence and liaise with the DPO and auditors
• Manage audit findings, remediation, and management assertions
• Operate the ISMS and AIMS with the Security Lead, including the risk register, statement of applicability, policy lifecycle, access reviews, internal audit, management review, and security steering cadence
• Own vendor policy and third-party risk processes, including intake, tiering, due diligence, DPA terms, AI-provider data-retention and no-training commitments, approval, re-review, and offboarding
• Manage subprocessor reviews, customer notifications, DPA updates, and portal updates
• Report to the Head of Engineering and work daily with the Security Lead

Compliance Manager

Strategist

• Investigate how customer work actually happens through interviews, data extracts, handoffs, exceptions and workarounds
• Build fact bases showing where cost, cash, service, cycle time or control is being lost
• Form and pressure-test hypotheses, including kill criteria
• Structure unfamiliar problems and frame selection equations for decision-making
• Turn analysis into decision-ready slides, one-pagers and memos
• Produce accurate materials with clear baselines, assumptions and evidence
• Deliver same-day or next-day outputs on defined asks
• Support multiple live enterprise accounts as analytical surge capacity
• Switch between category, supply chain, finance operations, inventory and commercial problem types
• Maintain a clear trail of actions, open questions and evidence
• Surface blockers and ambiguity early
• Help define baselines, targets and measurement windows before implementation
• Quantify outcomes in terms of revenue, margin, cost, working capital, cycle time and control
• Investigate both successful and missed results and create evidence packs
• Own working-level relationships with operators and mid-level process owners
• Prepare working sessions, capture decisions and follow up on commitments
• Escalate issues requiring senior input
• Collaborate with Transformation Strategists and Forward Deployed Engineers while not owning commercial negotiations, board-level relationships or technical build

Compliance Manager

Junior Transformation Strategist