Secure Data Exchange Compliance SME (Data Transfer)

About the role

Secure Data Exchange Compliance SME supports the Stay in Compliance Lead by managing compliance activities for the organisation's data transfer infrastructure. The role focuses primarily on secure data transfer products including Signiant Media Shuttle, Progress MOVEit and IBM Sterling, helping to maintain secure, supported and compliant services across internal, client-facing and DMZ-hosted environments.

Working with Infrastructure Operations, Network, Information Security, Service Management, application owners and vendors, the role detects and assesses alerts and vulnerabilities, supports risk-based prioritisation and remediation, improves patching and compliance processes, and produces governance reporting. The position provides product-specific subject-matter expertise and clear escalation to the Stay in Compliance Lead, without owning the broader infrastructure compliance programme.

Key responsibilities

• Serve as the product-specific compliance SME for Secure Data Exchange services.
• Maintain compliance visibility across Data Transfer products, including version, patch, support and lifecycle status.
• Monitor vendor, security and operational alerts; identify vulnerabilities and compliance gaps affecting data transfer products.
• Assess technical impact, affected versions, exploitability, workload criticality, exposure and business risk, and support risk-based prioritisation in line with agreed standards and SLAs.
• Coordinate remediation of Data Transfer product vulnerabilities, unsupported versions, configuration weaknesses and lifecycle risks with engineering and operations teams.
• Understand end-to-end client data transfer architecture, including internal and external transfer workflows, DMZ components, gateways or proxies, firewalls, certificates, service accounts, authentication, encryption and network dependencies.
• Assess controls for data in transit and at rest, external access, least privilege, logging, audit trails, file retention, malware scanning and segregation between internet-facing, DMZ and internal zones.
• Track remediation actions, ageing, exceptions, dependencies and closure evidence, escalating material risk, unsupported versions or delivery delays to the Stay in Compliance Lead.
• Maintain compliance records covering platform and application currency, asset ownership, security findings, approved exceptions, certificates, external exposure and control evidence.
• Prepare governance reports for the Stay in Compliance Lead, highlighting exposure, patch status, product risks, remediation progress and exceptions.

About you

• Knowledge of secure managed file-transfer products, particularly Signiant Media Shuttle, Progress MOVEIt and IBM Sterling.
• Understanding of client data transfer solutions and DMZ architecture, including secure gateways, proxies, reverse proxies, firewalls, load balancers, certificates, DNS, NAT, ports, protocols and internal-to-external trust boundaries.
• Understanding of secure transfer protocols and controls, including SFTP, FTPS, HTTPS, encryption, authentication, service accounts, role-based access, logging, retention and auditability.
• Understanding of vulnerability management, security alert handling, risk assessment, remediation SLAs, patch currency, configuration compliance and product lifecycle controls.
• Ability to interpret vendor advisories, CVEs, severity scores, release notes and scan findings and translate them into prioritised technical actions.
• Strong analytical and problem-solving skills, with attention to evidence quality, data accuracy, service availability and control traceability.
• Experience improving data transfer product compliance processes through standardization, automation and measurable controls.
• Clear written and verbal communication skills, with the ability to explain infrastructure and external data transfer risks to technical and non-technical stakeholders.
• Bachelor's degree in Computer Science, Information Technology, Engineering or a related technical discipline, or equivalent relevant experience.
• Relevant experience supporting enterprise data transfer services, with demonstrated involvement in vulnerability remediation, patch and upgrade coordination, DMZ-hosted services, compliance reporting or infrastructure operations.