Job Title Risk & Compliance Lead Reports to: Chief Operating Officer Location: Edinburgh or Glasgow, with travel required Designated roles: HMRC Compliance Officer and Data Protection Lead The Risk, Compliance & Governance Lead will operate and develop Rettie's governance, enterprise risk and compliance framework, providing specialist advice, constructive challenge, assurance and clear reporting to support proportionate decision-making and accountability. The role reports to the COO, who provides executive sponsorship for governance and enterprise risk and acts as Nominated Officer/MLRO. The Risk, Compliance & Governance Lead will line manage the Risk & Compliance Analyst and will remain accountable for the quality and effectiveness of the function's work. The postholder will also fulfil the designated role of HMRC Compliance Officer for Rettie's estate agency business and act as Data Protection Lead. Measures of success A practical, live enterprise risk framework supports Executive and Board decision-making. Material risks, compliance issues and remedial actions are visible, owned and escalated early. AML, data protection and other compliance arrangements are effective, evidenced and proportionate. The Risk & Compliance Analyst delivers timely, accurate monitoring, evidence and action tracking. Business leaders understand and accept ownership of risks and controls in their areas. Enterprise risk and governance Operate and continually improve the enterprise risk framework (currently in development) under COO sponsorship. Maintain the corporate risk register, risk matrix, risk appetite and tolerance documentation, key risk indicators and escalation arrangements. Facilitate risk reviews, ensuring principal and emerging risks have accountable business owners and proportionate controls. Prepare clear risk and assurance reporting for the COO, Executive Management Team and Board. Compliance and regulatory oversight Maintain a proportionate compliance framework covering AML and sanctions, data protection, consumer protection, anti-bribery and corruption, complaints governance, professional obligations and relevant regulatory requirements. Keep policies, controls and procedures current, lead regulatory horizon scanning and coordinate agreed changes. Provide practical advice and constructive challenge to senior leaders, managers and colleagues. Coordinate targeted external expertise and independent assurance where specialist depth is required. HMRC Compliance Officer Oversee Rettie’s compliance with the Money Laundering Regulations and applicable HMRC requirements across relevant branches and activities. Review the effectiveness of AML policies, controls and procedures, including the business-wide risk assessment, and oversee improvements. Maintain a risk-based AML monitoring and audit programme, supported by reliable management information and evidence. Oversee relevant employees, agents and third-party providers involved in identifying AML risk or operating controls. Report material weaknesses, breaches and overdue actions to the COO/MLRO, CEO and appropriate governance forum, and support HMRC inspections and independent audits. Maintain clear separation between the Compliance Officer’s oversight role and the MLRO’s responsibility for internal disclosures, SAR decisions and DAML or DATF requests. Data Protection Lead Maintain Rettie’s data protection framework, policies, privacy notices, records of processing, retention arrangements and accountability evidence. Advise on data protection risks arising from business change, technology, suppliers and AI, and coordinate DPIAs. Oversee data subject rights requests, personal data breaches and privacy incidents, including escalation, record-keeping and regulatory notification processes. Monitor compliance, coordinate engagement with the ICO and external specialists where required. Assurance, reporting and leadership Maintain an annual risk-based compliance and assurance plan and oversee monitoring, control testing and follow-up activity delivered by the Risk & Compliance Analyst. Analyse findings and management information, agree remedial actions with accountable owners and track delivery to completion. Line manage, coach and develop the Risk & Compliance Analyst, setting clear priorities and reviewing outputs. Build risk and compliance capability through practical guidance, training and a culture of ownership, transparency and early escalation. Authority and relationships Work closely with the COO/MLRO while retaining independent judgement and the ability to challenge. Have access to the people, systems, files, records and governance forums needed to fulfil the role. Maintain direct access to the CEO and appropriate Executive Management Team and Board forum where material, urgent or sensitive matters require escalation. Business leaders remain accountable for the risks and controls within their own areas.