Information Security, Compliance & Data Protection Manager

Information Security, Compliance & Data Protection Manager

Blue Matter is a rapidly growing strategic consulting firm serving clients in the life sciences industry. We partner with our clients to help them achieve commercial success across the lifecycle of their products, portfolios and organisations. Our project types include new product planning, launch strategy & planning, brand & life cycle planning and corporate & portfolio strategy, across a variety of specialty therapeutic areas.

We have a unique entrepreneurial culture and invest in building Blue Matter to be one of the best places to work. We have a strong global presence with offices in the US (San Francisco, New York, Boston), Europe (London, Zurich, Netherlands), and India (Mumbai, Gurgaon, Pune).

Why this role exists

Our clients are among the most security- and privacy-conscious organisations in the world, and they trust us with highly sensitive commercial and scientific information. As we scale our European operations and navigate increasingly complex data protection requirements, we need a dedicated owner for information security, compliance, and EU-focused data protection.

This role sits in our Technology & Operations team and is based in the UK, giving us strong coverage of GDPR and UK GDPR obligations, alignment with European clients and subsidiaries, and time-zone support for our global team. You’ll also serve as a key point of contact for our EU Operations team, providing hands-on IT support and helping ensure our European presence runs smoothly from a technology and compliance standpoint.

This is a hands-on, high-ownership role — not a tick-box function. You’ll build and run the firm’s security and compliance programme, act as our designated Data Protection Officer (DPO) for the EU, and be the trusted point of contact when clients ask how we protect their data. It’s ideal for someone who wants to shape a programme in a fast-moving, AI-forward consultancy rather than maintain one that already exists.

What you’ll do

• Security governance and strategy

• Own and run Blue Matter’s information security programme end-to-end.

• Conduct a comprehensive audit of the firm’s global security posture and translate findings into a prioritised remediation roadmap.

• Define, maintain, and operationalise security policies, standards, and procedures, and keep them current as the firm scales.

• Maintain the risk register, run regular risk assessments, and drive remediation to closure.

• Report on security and compliance posture to leadership in clear, business-oriented terms.

• Compliance and certifications

• Audit the firm’s compliance posture, with a focus on GDPR readiness across all operations — identify blind spots and build a path to audit-readiness.

• Support the SOC 2 Type 2 and HIPAA certification process for Twine, our analytics platform, building on the existing Type 1 attestation. (Note: this is product-scoped, not a company-wide certification.)

• Build a sustainable, “always-audit-ready” approach rather than a once-a-year scramble.

• Track relevant regulatory and framework developments and translate them into practical action.

• Data protection and privacy (DPO)

• Serve as the firm’s designated Data Protection Officer (DPO) for the EU.

• Lead data protection under GDPR and UK GDPR, with particular focus on cross-border data transfers between the EU, UK, and US — including evaluating options such as establishing an EU-based Microsoft tenant to keep EU data within European data centres.

• Audit how client information flows across jurisdictions: identify data that may fall under GDPR but is not currently categorised as such, and close those gaps.

• Maintain records of processing (RoPA), conduct Data Protection Impact Assessments (DPIAs), and own data-handling, retention, and minimisation policies.

• Manage data subject requests and any personal-data incidents, including regulator and individual notifications where required.

• Identify and address data protection risks across business functions, ensuring personal data is handled within approved systems and contractual frameworks.

• Client security assurance

• Own the response to client security due-diligence: complete security questionnaires and assessments from biopharma and medtech clients accurately and on time.

• Support commercial and contractual discussions on security, privacy, and data processing terms (e.g., DPAs).

• Maintain a library of reusable security documentation, certifications, and answers to accelerate client reviews.

• Microsoft 365 security operations

• Secure and govern our Microsoft 365 (E5) environment — Entra ID, Microsoft Defender, Microsoft Purview, and Intune.

• Own identity and access management: conditional access, MFA rollout, privileged access, joiner/mover/leaver processes, and least-privilege enforcement.

• Implement and tune data loss prevention (DLP), information protection/labelling, and device compliance.

• Partner with IT on secure configuration, patching, and endpoint hardening.

• EU Operations IT support

• Provide hands-on IT support for the EU Operations team, including on-site technical assistance when needed.

• Act as the day-to-day technology point of contact for European colleagues, ensuring they have the tools and infrastructure to work effectively.

• Support the growth of EU operations from a technology and compliance standpoint as the firm continues to expand in Europe.

• Third-party and vendor risk

• Run third-party and vendor risk management across our supply chain, including security review of new tools and AI/SaaS vendors.

• Maintain an inventory of vendors and their data access, and reassess risk on a regular cadence.

• Incident response and investigations

• Own and update the incident response plan; lead detection, triage, investigation, containment, and post-incident review.

• Investigate security events (for example, analysing Entra ID sign-in and audit logs), and produce clear, actionable incident reports.

• Run tabletop exercises so the firm is prepared before an incident happens.

• Security awareness and culture

• Build and deliver security awareness training and phishing simulations.

• Make security approachable and practical so the whole firm be