Compliance Officer

Location: UK remote - fully remote

Hours: 37.5 hours

Salary: Up to £45,000 per annum

About EnergySys: EnergySys is a platform used by software builders and consultants who serve oil and gas companies. Our partners build applications on top of us, and those applications run some of the most critical data and reporting workflows in the energy sector. We’ve been around for over 20 years, which means we’re not a startup bet. We’re an established business with a real product, real customers, and a PE‑backed growth target.

Our culture: EnergySys is shifting towards a high‑performing, high‑trust environment based on freedom and responsibility. That means we expect our people to take ownership, use their judgement, and care deeply about their impact. In return, we give them the space and trust to do the job the way they believe is best. This role is perfect for someone who wants to lead and build, not just follow a playbook.

Why this role exists: As the business scales, the need for structured governance, process integrity, and accountability across day‑to‑day operations has become a strategic priority. This role exists to own that accountability. The postholder will serve as the operational backbone of the company—ensuring that internal processes are documented, consistently applied, and aligned with applicable regulatory requirements. Working closely with the CEO and leadership team, they will maintain clear ownership of cross‑functional projects, people‑related processes, and compliance‑sensitive workflows, ensuring that nothing falls through the gaps as the business grows.

What you’ll be responsible for:

• Audit & Certification: You’ll own the ongoing SOC 2 Type II and ISO 27001:2022 audit lifecycle for an already‑certified organisation: surveillance and recertification audit planning, evidence readiness, auditor liaison, and remediation tracking. You’ll maintain the ISMS (including the Statement of Applicability) and handle customer security assessments and certification enquiries.
• Drata: Primary administrator. You’ll own framework configuration and control mapping, maintain integration health across AWS, Microsoft Entra ID, Intune, GitHub, Rippling, and connected systems. Automated evidence collection sits with individual control owners; you monitor for gaps or failures and keep owners accountable, keeping Drata and the ISMS manual consistent.
• Governance & Risk: Chair the Governance, Risk and Compliance Committee, owning the agenda and policy review cycle. Maintain the company risk register in Drata and report audit status, risk exposure, and control effectiveness to leadership and the board.
• Policy & Documentation: Own the policy register in Drata, ensuring policies stay current and accurate, updating them in response to regulatory changes or operational changes, and advising leadership on required updates.
• Vendor & Third‑Party Risk: Conduct and support structured vendor risk assessments, review SOC 2 reports, ISO certificates, and DPAs, maintain the vendor register, and ensure periodic reviews are completed on schedule.
• Infrastructure & Evidence: Navigate AWS, Microsoft Entra ID, Intune, and GitHub to pull evidence with little to no developer assistance. Use AI tools to accelerate evidence gathering, policy drafting, and control assessments. Support access management and joiner/mover/leaver processes from a governance perspective.
• Training, Culture & Regulatory: Administer cybersecurity awareness training via Rippling LMS and track completion against framework requirements. Support compliance across EnergySys’s three legal entities (UK, Australia, US), including GDPR and relevant data protection obligations. Embed a culture where compliance is practical, proportionate, and understood across the organisation.

What we’re looking for:

• Hands‑on SOC 2 and/or ISO 27001 experience: evidence management, direct auditor engagement.
• GRC platform experience (Drata, Vanta, or similar).
• Cloud literacy: comfortable navigating AWS and Microsoft Entra ID, or actively willing to learn.
• Strong written communication: policies, risk registers, committee papers & minutes.
• Self‑directed and ownership‑minded, able to run a compliance programme independently.
• AI‑native: you use LLMs and AI tools as genuine productivity accelerators.

In short: We need someone who maintains, operates, and owns; not someone who reports findings to others. You will be the sole compliance resource, working closely with the Head of Operations and engineering leadership. EnergySys is lean and fast‑moving; pragmatism and proportionality are valued over process for process’s sake. Drata is your tool, but the thinking, the judgement, and the ownership are yours.

What We Offer here @ EnergySys:

• Unlimited holiday — flexibility to take the time you need; we trust you to manage your time and deliver.
• Private medical insurance.
• EnergySys matches your contributions up to 8 % of salary.
• Enhanced parental leave — 3 months full pay maternity, 4 weeks full pay paternity.
• ISO 27001 Lead Implementer certification funded.
• Direct access to senior leadership — you will work closely with the Head of Operations and CEO with genuine influence.
• Real ownership — the compliance programme is yours to run; we have the foundations and the tools in place, but we need someone who takes initiative, sets the direction, and moves without waiting to be told.

How to Apply: Please send your CV alongside a brief cover note, no more than one page, addressing the following two questions: Describe a time you owned and improved an existing compliance programme rather than building one from scratch. What did you change, what resistance did you encounter, and how did you bring people with you? Walk us through how you’ve used a GRC platform (Drata, Vanta, or similar) to maintain audit readiness between certification cycles, including a time something slipped (a control owner missed evidence, an integration broke, a review lapsed) and how you caught and resolved it. We will read your CV for the technical baseline. The cover note is how we understand how you think and how you work with people. Keep it concise, quality over length. Applications without a cover note will not be progressed.