Compliance and IG Lead

About this role

Who are you?

We're looking for a pragmatic and hands-on Compliance and IG Lead to look after information governance, data protection and compliance at DrDoctor, who is also comfortable working through legal contracts. You'll make sure the right frameworks, policies and controls are in place to keep our patients' and clients' data safe. When the business needs to know what the regulation says, what the real risk is and what we should actually do about it, you'll be the person they turn to.

As well as setting our direction, you enjoy rolling your sleeves up and getting stuck in. You know a policy is no good if it sits on the shelf unused. You'll take a hard look at the processes we have, keep the ones that add value, cut the ones that don't and rebuild where we need to, leaving us with a lean way of working that gets the balance between pace and risk just right.

You don't have to be a qualified lawyer, but it would be a benefit. You might have been an IG Lead, Data Protection Manager or Privacy or Compliance Lead. As we grow into AI and medical devices, you'll work alongside our Clinical Safety Officer to bring the same rigour there, and help us get more value from our data while keeping it safe and lawful.

The relationships you build will be key to doing this well. You'll be comfortable working with people across every team and at every level, from engineers to the exec team, and confident challenging decisions when it matters.

The type of person you are

• Someone we can trust to produce accurate, high-quality work with minimal oversight
• Pragmatic, enjoys responsibility and has fun while working hard
• Diligent and detail-oriented, with a thorough, evidence-driven mindset, but not dogmatic or inflexible
• Comfortable navigating ambiguity and change with the ability to pivot quickly and bring stakeholders along with them
• A trusted advisor who builds genuine engagement across the business and at senior level
• Excellent collaboration, facilitation, presentation and communication skills

We'll support relevant qualifications for the right person.

OK, that’s me, but who are DrDoctor?

Take a look at our careers page or our website to find out a bit more about our mission, vision, and impact!

But ultimately, we the NHS and want to help it work better. We radically transform the delivery of health services to make healthcare work for everyone – for patients, doctors, administrative teams and taxpayers.

DrDoctor was built on a simple belief: technology can transform the NHS. Our B Corporation certification holds us accountable not just for what we build, but for how we build it - and the impact that has on people, patients and the health system around us.

️What would I be doing day to day?

One of the great things about DrDoctor is that every day is different and there is always an opportunity to get involved in something outside of your ‘BAU’ or your regular teams!

However, the key things you could expect would include

• Owning our information governance and data protection framework, including internal controls, SOPs, GDPR advice, DPIAs for all our products, DPAs, ROPA and privacy policies
• Keeping our information security controls effective, including vulnerability management, to protect the confidentiality, integrity and availability of our data
• Leading our ISO 9001, 14001 and 27001 certifications and keeping us compliant with the DSP Toolkit, including surveillance audits, records, continuous improvement and making sure our policies are followed
• Working with our Clinical Safety Officer to achieve ISO 13485 and Class 2 medical device certification, with rigour and minimal loss of pace
• Running supplier and subprocessor due diligence, managing information risk across the business and leading security and IG incident response, reporting and follow-through
• Reviewing and commenting on commercial contracts where needed to make sure all data, privacy and IG matters are compliant
• Maintaining our framework agreement templates and supporting client-facing teams with tenders, implementations and contract drafting
• Delivering training so our people understand their part in information security and can support our clients
• Giving pragmatic advice to the exec team on using data and AI to deliver company strategy, and reporting risk and compliance metrics to the relevant stakeholders
• Keeping compliance processes lean so they protect us without slowing product and engineering down

We’d love to find someone who loves to collaborate and enjoys being in person. We operate a remote by default working approach but we do have a London office which we’d love to see you in as often as you can, although this isn’t mandatory and it's definitely not a deal breaker! We have people based all over the UK, and in India and we’re very well set up for remote working!

Depending on your role, we'd usually expect people to be in the office for team collaboration, attending some of our in person events, or with clients on a semi regular basis. For some, this could mean travelling once a month, for others (particularly client facing roles), this might be more like once a week. We can give you more information about this during the interview process :)

OK, I’m interested. What experience do I need to have?

Must Have

• Strong, hands-on experience of GDPR and UK data protection, including DPIAs, DPAs, ROPA and data subject requests
• Hands-on information security experience, including managing vulnerability scanning and remediation and keeping security controls effective
• Experience running compliance frameworks and audits, such as ISO 27001, ISO 9001, ISO 14001, the DSP Toolkit or Cyber Essentials Plus
• Confident advising and challenging senior stakeholders, and building a compliance culture through training that people actually use
• You've owned, or played a big part in running, an information governance framework, including governance of sensitive or special category data
• You can read regulation and turn it into a practical recommendation: what's required, what the real risk is, and how we should approach it. You've done this in a technology business
• Enough contractual knowledge to negotiate the data protection, privacy and security clauses in client and supplier agreements, and to run supplier due diligence. You don't need to be a qualified lawyer

Nice to Have

• Exposure to clinical safety, medical device regulation or quality management systems such as ISO 13485
• Experience in healthtech, healthcare or the NHS, ideally working with patient data
• Experience advising on AI and new uses of data, helping teams get more value from data while staying compliant
• Interest in growing into wider commercial contracting alongside our CFO

Thinking of applying?

We know from research and experience that candidates may not apply if they don’t think they meet 100% of our requirements. If you don’t tick all the boxes but feel you would be a good fit, we would still love to hear from you. We are committed to creating a diverse and inclusive culture!

We’re happy to make reasonable adjustments at any stage of the hiring process and in the role.

Just to let you know too, we will need you to have the Right To Work in the UK.

We're perfect for each other, what are the next steps?

We are currently recruiting heavily and have a lot of CVs to go through. However, we don’t wait for roles to close before going through your CV. We will be in touch in a few days to let you know if we think we might be a match, and if we are not. Unfortunately, because we get so many CV’s we are not able to send a personalised reply if it’s not a match. However, if you want more details as to why, just drop us a note and we will arrange to get some feedback over to you.

If it’s a match, then we will arrange a time to talk to you on a quick 30 minute call.