Compliance Manager

WHO WE ARE Enterprise work still moves by hand: copy-pasting between spreadsheets, endless email threads, and clunky legacy UIs. We started Duvo to end that for good. We’ve already earned the trust of a range of customers, and our agents are helping them automate business-critical processes. We are growing fast, but to win from here we need exceptional people; that’s where you come in. WHAT WE ARE BUILDING We’re building the AI operations platform for large enterprises, currently focused on retail and consumer packaged goods customers. In Duvo, customers build AI agents that execute work wherever it needs to get done—SAP, spreadsheets, supplier portals, email, APIs, you name it. Duvo is heavy on browser and computer use. In Duvo, business users specify the outcome; agents plan, act, request approvals on exceptions, and learn with every run. To help customers understand what to automate, we also help them map their processes by digesting interviews and internal documentation, which gets our foot in the door. We start with automating the parts of companies that we know best (category management, supply chain, finance ops) where we can show value fast, then expand to adjacent functions and sectors. Velocity is our moat: ship fast, iterate faster, compound learning. THE ROLE You are the function owner and, for now, its sole occupant. You report to the Head of Engineering and work daily with our Security Lead - you jointly own policies, access reviews, incident evidence and our Trust Center configuration. You are succeeding in the role when a buyer, an auditor, or a regulator’s customer can get an accurate, evidenced answer about the Duvo the first time they ask. You decide what ships in a questionnaire, whether a vendor passes review, and how the answer library is structured and governed. WHY THIS ROLE EXISTS Our agents hold credentials to customers' core systems and act inside them. That makes every enterprise deal a security review, and every security review a test of whether we can produce a straight, evidenced answer quickly. We hold SOC 2 Type II, ISO 27001, ISO 42001, GDPR and NIS2 commitments, and the surface keeps growing. Banks and telcos now ask about our subprocessor chain because their own regulators require it of them. This role makes Duvo reviewable. We need someone to own the answers, the evidence, the audits and the vendor chain. WHAT YOU'LL OWN The Q&A library - our source of truth. Every due-diligence answer we have, mapped to ISO 27001, SOC 2, ISO 42001, NIS2 and GDPR. Each row carries an owner, approval status, evidence link, confidentiality class and review date. Fast-moving facts get reviewed monthly, process answers quarterly, stable facts annually. One version of every fact across the library, the trust center, the Trust Center portal, our policies and what engineering actually does — with write-back from every questionnaire, audit finding and product change. Customer security reviews. Intake to…