Want to know if this job is worth applying to?
Manchester, England, United Kingdom
Hybrid
The role
The Head of Compliance & Data Privacy leads the day-to-day operation and continuous development of Avalere Health’s global compliance and data privacy programmes. The role helps the business manage regulatory, client and reputational risk through pragmatic, business-enabling advice and effective controls.
Reporting and collaboration. Reporting to the GC, the role works with senior leaders and relevant functions across the business, escalates material risks, and applies group standards while addressing applicable laws, regulations and business needs across relevant jurisdictions.
Lead by Example: Promote a positive, ethical culture across the business and model the standards expected of others.
Compliance programme
Lead and develop Avalere Health’s global compliance programme.
Provide pragmatic compliance advice, assess new business initiatives, and escalate material risks to the General Counsel with clear options and business implications.
Monitor regulatory developments and support the implementation of proportionate controls and governance processes.
Data privacy
Manage privacy compliance and risk across the organisation in line with applicable global privacy requirements, escalating significant matters to the General Counsel as appropriate.
Advise on responsible data use, privacy by design, safeguards and proportionate controls, and assess privacy risks arising from new products, systems, suppliers, services and data uses, including international transfers and third-party processing.
Manage or support key privacy processes, including DPIAs, DSRs, privacy notices, ROPAs and personal data incident assessment.
AI compliance
Monitor applicable AI legislation, regulatory guidance, industry expectations and client requirements and translate requirements into proportionate, practical compliance processes and controls for Avalere Health’s services, internal use of AI, suppliers and business development activity.
Support assessment of AI use cases, including risk identification, documentation, human oversight, data protection considerations, vendor due diligence and approval requirements, working with the AI governance team, Legal, Information Security, Technology and business stakeholders to embed AI compliance requirements.
Anti-bribery, conflicts and third-party due diligence
Advise on and support the effective operation of anti-bribery and anti-corruption controls, including conflicts of interest, gifts, hospitality and interactions with third parties.
Oversee proportionate, risk-based due diligence on clients, suppliers and other third parties. Identify, document and escalate due diligence concerns, ensure required mitigations and approvals are in place, and refer matters outside delegated authority.
Complete relevant sections of client questionnaires and due diligence materials and support KYC and KYV processes.
Policies, training, assurance and reporting
Maintain and evolve compliance, privacy and AI compliance policies, procedures, guidance and governance frameworks. Manage training, completion monitoring, records and targeted awareness activity.
Coordinate compliance, privacy and AI compliance monitoring, control reviews and assurance activity. Prepare clear reporting and insights on material risks, incidents, trends, outstanding actions and lessons learnt for senior leadership and relevant governance forums.
Incidents, investigations and external requests
Manage reported compliance, privacy and AI compliance concerns, incidents and investigations.
Work with stakeholders and SMEs to preserve records, document findings, identify root causes, track remediation and coordinate compliance and privacy responses to regulators, auditors and substantive client requests as applicable.
Leadership and stakeholder engagement
Provide clear direction, supervision and development support to direct reports.
Build effective working relationships with senior and non-specialist stakeholders, adapting communication to the audience and securing engagement with compliance, privacy and AI compliance requirements.
Work closely with Information Security, Technology, People and other functional teams to ensure compliance, privacy and AI compliance input supports fair, consistent and commercially practical outcomes.
Translate complex compliance and privacy issues into clear, actionable advice that supports informed decisions and balances commercial objectives, risk and ethical standards.
Substantial compliance and data privacy experience gained in-house, in professional services or in a regulated environment, including hands-on experience operating or improving compliance programmes.
Global data privacy experience: Practical experience of DPIAs, DSR requests, personal data breaches, privacy notices and records of processing activities (ROPAs), with strong knowledge of UK and EU GDPR, an understanding of HIPAA, and awareness of other global privacy requirements relevant to an international business.
AI compliance experience: Working knowledge of the EU AI Act and experience assessing AI use cases, advising on implementation, risks and applying compliance controls within a wider governance framework.
Due diligence and ABAC: Experience of third-party due diligence, anti-bribery and anti-corruption controls, and conflicts-of-interest processes.
Confidentiality and accountability: Strong ownership, follow-through, integrity and discretion when handling sensitive matters, with sound judgement about when to escalate for approval.
Senior stakeholder advisory: Ability to advise senior leaders on sensitive compliance and privacy matters and translate material risks into practical business options.
Leadership accountability: Experience setting expectations, reviewing work, managing performance and coaching team members to build capability.
