At a Glance
- Tasks: Automate compliance processes and build systems for continuous audit readiness.
- Company: Join Fresha, a leading AI-powered platform in the beauty and wellness industry.
- Benefits: Competitive salary, flexible work environment, and opportunities for professional growth.
- Other info: Dynamic team culture focused on innovation and rapid growth.
- Why this job: Be the first GRC Engineer and shape compliance automation at a unicorn startup.
- Qualifications: 3+ years in software engineering with strong coding skills in Python or Go.
The predicted salary is between 63000 - 77000 £ per year.
About Fresha
Fresha is the leading AI-powered operating system for the global beauty and wellness industry, giving businesses everything they need to run smarter, grow faster and build stronger client relationships. Our mission is simple: help beauty and wellness businesses grow by giving them the technology they need to attract clients, manage their operations and run their business in one place.
Role Overview
You’ll join the Compliance team and report to the Head of Compliance. We want an engineer first, not a compliance expert: someone who understands regulation and builds systems that prove compliance continuously and automatically. You’ll work closely with Security, Platform, IT and product engineering teams. This is our first GRC Engineer hire.
What You’ll Do
- Automate evidence: Build integrations that pull control evidence from cloud, identity, endpoint, CI/CD and HR systems into Sprinto, our compliance platform.
- Monitor controls continuously: Write checks that catch drift in access, encryption, logging, patching and change approval, and alert the owner.
- Ship compliance as code: Put guardrails in pipelines and infrastructure as code so non-compliant changes fail before production.
- Map once, comply many: Run one control set mapped to PCI DSS, ISO 27001, HIPAA, SOC 2, GDPR and NIS2.
- Own the platform: Keep Sprinto clean as the system of record. Fix broken integrations, controls and ownership.
- Build PCI DSS Level 1: We’re building the programme now. Bake automation into controls, scope, cardholder data flows and network diagrams from day one, generated from source where possible.
- Make audits boring: Give auditors repeatable, automated evidence and lead technical walkthroughs.
- Work with engineering teams: Turn findings from Security, Platform and IT into fixes engineers can ship, as PRs and tickets.
- Report: Dashboards on control health, evidence freshness and audit readiness for leadership.
- Shape AI governance: Help build AI controls as the EU AI Act lands.
What We’re Looking For
- Experience: 3+ years as a software, platform, cloud, SRE or security engineer. Compliance automation experience is a strong plus.
- Code: Strong in Python, Go or similar. You’ve built and run production services and integrations, not just scripts.
- Cloud: Hands‑on experience (AWS preferred): IAM, logging, and infrastructure as code such as Terraform.
- Frameworks: Familiar with at least one of PCI DSS, ISO 27001, SOC 2 or HIPAA.
- Compliance platforms: Experience with Sprinto, Vanta, Drata or similar, and their integrations.
- Delivery: CI/CD and git‑based workflows (for example GitHub Actions).
- Evidence you can defend: You think about what happens when an integration silently stops or a check passes on the wrong data.
- AI in your workflow: You use AI tools day to day, know where they help and where they don’t, and review what comes back before it ships.
- Clear writing: You can explain a control to an engineer and a risk to an exec.
- Ownership: You’ll shape how a lean team works, not follow a playbook.
Bonus: PCI DSS Level 1, payments or fintech experience; SIEM, FIM or CSPM tooling; GDPR, NIS2 or EU AI Act knowledge; certifications such as CISSP, CISA, CCSP, ISO 27001 Lead Auditor or AWS Certified Security - Specialty.
At Fresha, we value passion and potential as much as specific skills. If you're enthusiastic and eager to learn, we encourage you to apply, even if you don't meet every listed requirement.
Your Opportunity at Fresha
- Scale: Around 1 million bookings a day across 120 countries, and the payments that go with them.
- Ownership: You’re our first GRC Engineer, joining while we build PCI DSS Level 1.
- Breadth: Four frameworks live, PCI DSS Level 1 in build, SOC 2 and the EU AI Act next.
- Speed: Around 3,000 deploys a week.
Interview Process
- Screen Stage - Video call with a member of the Talent Team (30min)
- 1st Stage - Video interview with the Head of Compliance (45-60min)
- 2nd Stage - Live technical session: automate evidence for one real-world control (60-90min)
- Final Stage - Video interview with VP of Security & Compliance / CTO (45-60min)
Inclusive workforce
At Fresha, we are creating a culture where individuals of all backgrounds feel comfortable. We want all Fresha people to feel included and truly empowered to contribute fully to our vision and goals. Everyone who applies will receive fair consideration for employment.
Compliance (GRC) Engineer (London) employer: Fresha
Fresha is an exceptional employer, offering a dynamic work environment in the heart of London, where innovation meets inclusivity. With a strong focus on employee growth, Fresha provides opportunities for professional development and collaboration across diverse teams, ensuring that every voice is heard and valued. Join us to be part of a forward-thinking company that empowers you to make a meaningful impact in the beauty and wellness industry.
StudySmarter Expert Advice🤫
We think this is how you could land Compliance (GRC) Engineer (London)
✨Join Compliance Communities
Get involved in compliance and risk communities — both online and offline. Look for forums, LinkedIn groups, or even local meetups where compliance pros hang out. You never know who might drop a job opportunity your way!
✨Attend Industry Conferences
Keep an eye out for compliance and risk management conferences and workshops in your area. These events are a goldmine for networking, and they often have job boards or recruiters on-site looking for new talent. Plus, it’s a chance to learn what's trending in the field.
✨Leverage Your University Career Services
If you’ve recently graduated or are still studying, head over to your university's career services. Many companies, including those in compliance, actively recruit fresh talent through these services, so make sure you tap into that resource.
✨Showcase Your Knowledge Online
Start writing articles or blog posts about compliance topics that interest you. Share them on platforms like LinkedIn to demonstrate your knowledge and passion. This not only builds your presence in the field but can also catch the attention of companies like Fresha looking for candidates who are engaged and informed.
We think you need these skills to ace Compliance (GRC) Engineer (London)
Some tips for your application 🫡
Show Your Understanding of Compliance:In the compliance-risk field, it's super important to showcase your understanding of regulations and risk management frameworks. Highlight any relevant coursework, certifications (like ICA or AML), or even projects that demonstrate your knowledge and commitment to this area. We want to see how you can navigate this complex landscape!
Quantify Your Achievements:When detailing your experience, try to quantify your achievements. For example, if you've previously worked on a project that improved compliance metrics or reduced risk exposure, give us the numbers! This data-driven approach really stands out to hiring managers in compliance-risk roles.
Tailor Your CV to Reflect Relevant Skills:Make sure your CV highlights skills that are particularly relevant to compliance, like attention to detail, analytical thinking, and report writing. Ensure these are easy to spot – consider using bullet points to break down your responsibilities and achievements for maximum impact!
Craft a Motivating Cover Letter:In your cover letter, let us know why you’re excited about the compliance-risk role at Fresha. Share what motivates you about compliance, and how you believe you can contribute to our mission. This is your chance to showcase not only your skills but also your passion for this important field!
How to prepare for a job interview at Fresha
✨Master the Regulations
Brush up on key compliance regulations relevant to the industry you're applying to. Familiarising yourself with specific laws and frameworks used in your field will give you an edge during technical questions. Show that you’re not just aware of them but can also apply them—think real-life scenarios!
✨Show Your Analytical Skills
Compliance roles really focus on analytical skills, so be prepared for case studies or situational questions during the interview. We've got to demonstrate how we approach risk assessments or compliance audits, possibly drawing on examples from past experiences or university projects. Bring some thoughtful case scenarios to discuss!
✨Know Your Tools
Get comfortable with commonly used compliance software and tools. Familiarity with platforms like RSA or MetricStream can really impress during your interview, as it shows you're ready to hit the ground running. If you’ve had any experience with them, make sure to highlight that!
✨Align with Company Culture
Since it's a full-time position, show your long-term commitment and interest in the company’s mission and values. Dive into how your ethics and professional philosophy align with Fresha’s stance on compliance. A shared vision can really resonate with interviewers looking for fit as much as skill!
