Data Governance Consultant

Company Overview

EC Markets is a globally recognised financial brokerage, providing advanced FX and CFD trading services.

As part of its growing finance team, EC Markets is seeking an Accounts Assistant to support daily financial operations and reporting, ensuring compliance, accuracy, and efficiency across the department.

Role Purpose

Support the business in achieving launch readiness by assessing, documenting and implementing the data governance, privacy and information security controls required for an FCA-regulated financial services platform.

Key Responsibilities

• Data Discovery & Governance
• Lead an end-to-end review of customer data across the organisation, including what data is collected, why it is collected, where it is stored, who has access, how it moves through systems, and who external processors are.
• Deliverables: data inventory, data classification framework, Information Asset Register, data flow diagrams.
• GDPR & Privacy
• Review compliance with UK GDPR and Data Protection Act requirements, including lawful basis, consent, retention, deletion, subject access requests, international transfers, processor agreements.
• Deliverables: gap assessment, risk register, required remediation plan.
• Data Security Review
• Assess current controls covering RBAC, MFA, encryption, secrets management, audit logging, backup strategy, disaster recovery, production access.
• Identify launch-critical risks.
• AI & Data Usage Governance
• Review the use of Claude, Snowflake, other LLMs, and internal reporting tools.

Define acceptable use, access model, PII handling, prompt handling, data retention, user permissions.

• Produce governance recommendations.
• Third Party Risk
• Review all vendors processing customer data, including cloud providers, AI providers, communications platforms, and payment providers.

Ensure processor agreements, data residency, contractual protections, and security posture are appropriate.

• Policies & Documentation
• Produce or review Privacy Notice, Data Retention Policy, Information Security Policy, Data Classification Policy, Access Control Policy, Incident Response Plan, Data Governance Policy.
• Launch Readiness Assessment
• Produce a quick-turnaround executive report identifying green, amber, and red items with clear, prioritised actionable tasks.
• Success Criteria
• By the end of the engagement, the business should be able to confidently answer questions about customer data, its storage, access, suppliers, sensitivity, and regulatory compliance with evidence.

Essential Requirements

• Regulatory & Compliance Background
• Experience leading data governance and privacy programmes for FCA-regulated or financial services businesses.
• Prior experience supporting FCA authorisation or regulated product launch, preferably in fintech or payments.
• Strong working knowledge of UK GDPR and the Data Protection Act 2018.
• Practical understanding of FCA expectations around data handling and customer outcomes.
• Experience producing gap assessments, risk registers, and remediation plans that stand up to regulatory scrutiny.
• Data Discovery & Documentation
• Hands‑on experience running end‑to‑end data discovery and mapping across an organisation.
• Track record of producing data inventories and data classification frameworks from scratch.
• Experience building Information Asset Registers and data flow diagrams.
• Ability to identify data processors and third parties handling customer data during discovery.
• Technical Security Assessment
• Ability to assess technical security controls directly with engineering teams.
• Working knowledge of RBAC and MFA implementation.
• Familiarity with encryption standards and secrets management.
• Experience reviewing audit logging, backup strategy, disaster recovery, and production access controls.
• Ability to translate technical findings into launch‑critical risk ratings for non‑technical stakeholders.
• AI, Data & Vendor Governance
• Governing AI/LLM tools (e. g., Claude) in a regulated environment, including acceptable use and access models.
• Understanding of PII handling and prompt handling risk in AI workflows. Experience with data platform governance (Snowflake), data retention and user permissions.
• Experience conducting third‑party and vendor risk assessments.
• Knowledge of data residency requirements and contractual/processor agreement protections.
• Delivery, Communication & Working Style
• Track record of producing clear, regulator‑ready policy documentation at speed.
• Comfortable operating as an autonomous, hands‑on contractor in a lean startup environment.
• Ability to prioritise launch‑critical risk over process, making pragmatic calls.
• Strong stakeholder management skills across Product, Technology, Operations, Risk and Compliance.
• Translate technical and regulatory detail into clear executive‑level narratives.
• Proven ability to deliver a full assessment and documentation set against a tight deadline ahead of a live launch.
• Location
• 30 City Road, London
• #J-18808-Ljbffr