Compliance Manager

The role

You will own the compliance function as its sole occupant, reporting to the Head of Engineering. You will manage the Q&A library, customer security reviews, audit and certification programs, and third-party risk.

What you will do

• Manage the Q&A library as a source of truth for ISO 27001, SOC 2, ISO 42001, NIS2 and GDPR.
• Handle customer security reviews from intake to delivery.
• Maintain the public trust center and NDA-gated Trust portal.
• Run the annual audit and certification calendar including SOC 2 Type II, ISO 27001, ISO 42001, and NIS2.
• Conduct evidence gathering and act as DPO and auditor liaison.
• Operate the ISMS and AIMS including risk registers and policy lifecycles.
• Own the vendor policy and third-party risk process.
• Manage the subprocessor list and customer notifications.

Required qualifications

• You've run a certification programme end to end including SOC 2, ISO 27001 or equivalent through a real audit cycle.
• You write precise, evidenced, and honest answers.
• You have experience with third-party risk and running a vendor review process.
• You have evidence discipline to capture data while work is happening.
• You have judgement regarding when to escalate to Engineering, Security, or legal.
• You use AI tooling properly.
• You have plain writing skills.

Nice to have

• Have dealt with financial services or telco buyers regarding DORA and NIS2.
• Have worked on AI governance or ISO 42001 specifically.
• Have run a GRC platform Vanta, Drata, Mycroft, Segregato or similar.
• Have sat on the vendor side of the table as a processor.

Benefits

• Unlimited AI budget.
• Autonomy to do your best work.
• A real AI product with real customers.

Before you apply

• Final round involves meeting the team in Prague.

About the company

Duvo is building an AI operations platform for large enterprises, currently focused on retail and consumer packaged goods customers. The company uses AI agents to automate business-critical processes.