Compliance Engineer

The Compliance Engineer designs, implements, and maintains the Group's information security compliance framework, ensuring the company meets regulatory, legal, contractual, and internal security requirements across all entities in scope.
The role bridges technical security controls and governance requirements: translating standards and regulations into implementable controls, and maintaining the evidence base needed to demonstrate compliance to management, customers, and external auditors.
The role directly supports the Digital Fortress objective of policy-driven infrastructure governance, ensuring compliance and uptime.

Key Accountabilities:
• Design, implement, and maintain the information security compliance programme aligned to ISO/IEC 27001, ISO 22301, NIST CSF, CIS Controls, and applicable national regulatory requirements.
• Translate compliance, regulatory, and contractual requirements into specific, testable technical and operational security controls.
• Develop, review, and maintain security policies, procedures, standards, and guidelines, and manage the policy review cycle.
• Work with Network, System, Datacenter, and Customer Service teams to confirm controls are correctly implemented, operating, and documented.
• Conduct security compliance risk assessments and control gap analyses against the applicable frameworks.
• Maintain the compliance risk register and track remediation of non-conformities and audit findings to closure against agreed SLAs.
• Coordinate and support external audits, including certification, regulatory, and customer audits: manage scheduling, scope, auditor logistics, evidence packs, and responses to findings.
• Prepare and maintain the internal audit program, scope, and schedule, and coordinate its execution by an independent reviewer.
• Validate that BCP/DR arrangements meet ISO 22301 and internal recovery requirements, and confirm that test evidence is captured and retained.
• Participate in incident response to confirm regulatory, contractual, and internal notification and record-keeping obligations are met.
• Provide security compliance guidance to technical and non-technical stakeholders across Group entities.
• Contribute security compliance requirements into D&T projects at design stage, including ERP, infrastructure modernization, and OT-to-IT integration initiatives.
• Monitor emerging regulations, standards, and practice, and assess impact on the Group control environment.