Assist with completion of client due diligence and assurance questionnaires.
Contribute to vendor and third‑party risk management, including vendor security assessments, audits and ongoing monitoring.
Support ISO 27001 certification, including internal and external audits, maintaining documentation, assisting with remediation plans and tracking corrective actions.
Participate in security threat preparedness and incident response activities.
Maintain the risk & compliance governance page on the firm’s intranet portal.
Act as an internal point of contact for general risk & compliance queries.
Ongoing regulatory horizon scanning, with particular focus on developments in data protection, AI regulation and information security.
Responsibility for firmwide policy management, including drafting, reviewing, maintaining and updating Risk & Compliance policies and procedure.
Contribute to policy compliance training initiatives across the firm.
Ensure policies remain aligned with new and evolving regulation and best practice.
Assist with Data Protection governance, including end‑to‑end management of Data Subject Access Requests (DSARs) and Data Deletion Requests.
Maintain and update internal data protection policies and procedures.
Review client and vendor data processing agreements (DPAs), privacy notices, and data protection contractual clauses.

Relevant 3rd level qualification in corporate law, data protection or related field.
Minimum 2-3 years’ experience in a risk, compliance or regulatory role, ideally within a corporate law firm, professional services or large corporate environment.
Professional certification (e.g., CIPP/E, CIPM) is highly desirable.
Familiarity with regulatory frameworks including GDPR and Data Protection Act 2018.
Excellent attention to detail and organisational skills.
Strong written and verbal communication skills.
Ability to engage confidently with senior stakeholders.
Sound judgement and ability to deal with sensitive issues discreetly.

Risk and Compliance Officer

Key skills