Technical Compliance Lead (Must be in UK)

The Technical Compliance Lead at PolyAI is responsible for enforcing Compliance and Security processes across the company. Main duties include supporting the Engineering team, conducting compliance certification audits, and ensuring the security of production environments. This entails collaborating with IT and DevSecOps teams, managing vulnerabilities, and contributing to technical documentation related to security and compliance policies.

To be successful as a Technical Compliance Lead at PolyAI, candidates should possess 3-5 years of experience in a technical role with compliance requirements. Familiarity with compliance audits such as ISO27001 and SOC-2 Type 2 is essential, as is experience in maintaining security in cloud environments like AWS. Excellent communication skills and knowledge of secure coding are preferred.

As a Technical Compliance Lead at PolyAI, you will work with a variety of tools and technologies, including AWS, GCP, Azure, GitHub, and cloud security platforms like Orca or Wiz. Experience with compliance management platforms such as Vanta, along with vulnerability management tools and patching solutions, will also be part of your day-to-day responsibilities.

PolyAI provides a comprehensive benefits package to its Technical Compliance Lead, including flexible working options, a yearly learning budget, enhanced parental leave, and the opportunity to participate in the company's employee share options plan. Additionally, employees enjoy a generous holiday allowance and wellness programs including private healthcare and mental health support.

The Technical Compliance Lead at PolyAI plays a key role in ensuring that the company's voice assistants operate securely and effectively. By maintaining compliance with industry standards and managing vulnerabilities, this position directly supports the production environment, which helps enhance customer satisfaction by delivering a reliable service that protects client data.

To ensure compliance requirements are met, I would start by thoroughly understanding applicable regulations and best practices. During project planning, I would collaborate with the team to integrate compliance checkpoints and regularly review documentation to make adjustments as needed. Regular audits and communication with stakeholders also play a key role.

In my previous role, I was responsible for leading an ISO27001 compliance audit. This involved organizing documentation, coordinating meetings with internal teams, and addressing findings. I maintained open lines of communication with auditors to clarify requirements and subsequently implemented corrective actions to enhance our compliance posture.

I have hands-on experience with several cloud security platforms like Orca and Wiz. I utilized these tools to identify vulnerabilities, conduct risk assessments, and implement security measures that align with our compliance requirements. I appreciated how these platforms automated many processes, enhancing our efficiency and overall security.

Staying updated is crucial in my role. I regularly follow trusted industry publications, attend webinars, and participate in professional associations focused on compliance and security. Networking with peers also provides insightful perspectives on emerging trends and actionable strategies.

One of the biggest challenges is managing the balance between innovation and compliance. It’s essential to adopt new technologies while ensuring they meet established guidelines. I focus on proactive communication with stakeholders to address compliance concerns early in the development process.

Effective communication involves clarity and collaboration. I break down complex compliance requirements into actionable tasks and share them during team meetings or huddles. I also ensure to provide documentation that outlines expectations and offer training sessions to enhance understanding.

For vulnerability management, I recommend tools like Tenable or Intruder.io due to their comprehensive scanning capabilities and user-friendly interfaces. They help identify vulnerabilities promptly, allowing teams to prioritize remediation efforts effectively.

Upon receiving audit findings, I prioritize them based on risk and impact. I work closely with the relevant teams to develop action plans that involve timely remediation. It’s important to establish a tracking mechanism to ensure accountability and follow-through.

Secure coding practices are vital to mitigate risks associated with software vulnerabilities. By implementing security measures from the outset, we can prevent potential attacks and data breaches. I promote secure coding through training and code reviews to raise awareness among development teams.

To enhance PolyAI's security posture, I would implement a continuous monitoring system, regular training for employees on security awareness, and a robust incident response plan. I would also advocate for regular penetration testing to assess vulnerabilities proactively.