Senior Manager – Compliance

Reports To Partners

Direct Reports None

Location Auckland

Employment Type Permanent, Full Time

Qualification Requirement Chartered Accountant or equivalent

Practising Requirement Current Public Practice Certificate (PPC) with ability to review and sign o client work

Role Purpose

The Senior Manager – Compliance is responsible for the e ective planning, coordination, review and delivery of the firm’s compliance programme.

The role will take ownership of compliance scheduling and workflow across the firm, ensuring work is progressed e iciently, completed to the required technical standard and delivered within agreed filing deadlines.

This is predominantly a review, quality control and workflow management role rather than an accounts preparation position. The Senior Manager will work closely with the Partners, Senior Managers and outsourced accounting provider to ensure compliance work moves e iciently through the business.

A key objective of the position is to enable the Partners to step away from the day-to- day management and delivery of compliance activity.

Key Accountabilities

Compliance Planning & Workflow

 Take ownership of the firm’s annual compliance programme, including scheduling and monitoring workflow.

 Maintain clear oversight of upcoming filing requirements, deadlines and priorities.

 Monitor progress against agreed compliance and filing targets.

 Identify potential workflow issues or delays and take appropriate action to keep work progressing.

 Ensure work is appropriately allocated between the internal team and outsourced accounting provider.

 Maintain visibility over the status of compliance work and provide regular updates to the Partners and wider team.

 Ensure outstanding matters are actively followed through to completion.

Review & Quality Control

 Review financial statements, income tax returns, GST returns, workpapers and supporting documentation prepared by others.

 Ensure work is technically accurate, complete and consistent with firm standards.

 Review and update resolutions, minutes and other associated statutory documentation as required.

 Identify and resolve technical or quality issues.

 Sign o client work where appropriate and within the scope of the position holder’s Public Practice Certificate.

 Maintain appropriate quality control processes across the compliance function.

Outsourced Provider Management

 Coordinate workflow with the firm’s outsourced accounting provider, Connect.

 Ensure work provided externally is appropriately scoped, prioritised and scheduled.

 Review the quality and completeness of work returned.

 Monitor turnaround times and address issues that impact the e iciency of the compliance process.

 Identify opportunities to improve the e ectiveness of the outsourced relationship.

Process Improvement

 Review existing compliance processes and identify opportunities to improve e iciency, consistency and throughput.

 Develop practical processes and controls that provide greater visibility over compliance workflow.

 Support the use of technology, automation and AI-enabled tools where these can improve the quality or e iciency of compliance delivery.

 Promote consistent ways of working across the firm.

Team & Stakeholder Support

 Work collaboratively with Partners and Senior Managers to ensure compliance requirements are appropriately prioritised and delivered.

 Provide technical guidance and support to other members of the team where required.

 Influence workflow and outcomes without relying on formal reporting lines.

 Build strong working relationships across the firm and with external service providers.

 Contribute positively to the firm’s collaborative and team-based culture.

Key Measures of Success

 Full ownership of the firm’s compliance schedule and workflow.

 Compliance work completed in line with agreed internal and statutory filing targets.

 Clear visibility across the business of compliance progress, priorities and outstanding work.

 Reduced Partner involvement in the day-to-day management and delivery of compliance work.

 Consistent quality and accuracy of reviewed compliance work.

 E ective utilisation and management of the outsourced accounting provider.

 Improved e iciency and consistency of compliance processes.

 Strong follow-through, with work progressed and completed without unnecessary delays.

Experience & Qualifications

 A current Public Practice Certificate, with the appropriate experience and authority to review and sign o client work.

 CA qualification or equivalent.

 Significant experience within a New Zealand chartered accounting or professional services firm.

 Strong working knowledge of New Zealand accounting, taxation and compliance requirements.

 Demonstrated experience reviewing financial statements, tax returns, GST returns and associated workpapers.

 Experience managing or coordinating a significant volume of compliance work.

 Experience working with outsourced or o shore accounting providers would be advantageous.

 An understanding of how technology, automation and AI can be applied to accounting and compliance processes.

Skills & Capabilities

 Strong planning, organisation and workflow management capability.

 Excellent attention to detail and commitment to quality.

 Strong technical accounting and tax judgement.

 Ability to prioritise and manage multiple competing deadlines.

 Strong follow-through and a focus on completing work.

 Ability to identify issues early and take practical action to resolve them.

 Confident reviewing the work of experienced accounting professionals.

 Collaborative and able to influence others without formal authority.

 Pragmatic and commercially minded.

 Comfortable working within a flat organisational structure.

Key Relationships

Relationship Key Stakeholders

Internal Partners; Senior Managers; wider accounting team

External Connect outsourced accounting team; clients as required; other professional advisers and external parties where relevant

Organisation & Team Structure

The firm comprises approximately 18 employees, including 12 accounting professionals and two Partners

The organisational structure is deliberately flat, with experienced Senior Managers responsible for their own client portfolios and no traditional junior or intermediate accounting layer. Preparation-level work is largely supported through the firm’s outsourced accounting provider.

The Senior Manager – Compliance will not have direct reports but will play a key role in coordinating compliance activity across the wider team.

Role Context

The role has been created to support the ongoing growth and development of the firm and the addition of new client portfolios.

The firm is also progressively refining its client base, with a focus on reducing unnecessary compliance volume while increasing the quality of clients and the level of value-added advisory support provided.

Current service delivery is approximately 60% compliance and 40% advisory, including business planning, forecasting, monthly / quarterly client advisory meetings, valuations, succession planning and CFO type services.

The firm predominantly works with privately owned businesses, typically with annual revenue of approximately $1 million to $10 million.

Remuneration

Indicative remuneration is expected to be in the range of $160,000–$180,000, depending on experience and the overall remuneration structure agreed.

Alternative remuneration structures, including performance or profit-related components, may be considered.

Equity is not currently part of the position.

Service Delivery Manager

Job Details

Location Role type Work model Reports to Direct reports

Auckland Permanent, full-time Hybrid CEO Yes

Last updated August 2026

SERVICE IS WHERE TRUST IS WON OR LOST.

Medtech Global has spent 30 years building technology that supports clinicians across New Zealand and Australia. We have deep institutional knowledge of how healthcare actually works, and a clear-eyed view of where it needs to go.

A practice does not experience our roadmap. It experiences the weekend the migration ran long, the call that was answered well, the training that finally made a feature make sense, and the ticket that went quiet. For our customers, that is the product. This role owns it end to end.

We are building what comes next, without stopping what works today. Around 1,300 practices across two countries depend on us in the meantime, and every one of them meets Medtech through the same three teams: the support desk that answers when something breaks, the field team that trains and upskills them, and the implementation team that brings them onto our platform. This role leads all three, in both markets.

WHY THIS ROLE EXISTS

We know what our customers currently think of us, because we asked them. The answer was not good, and we are not going to pretend otherwise. Fixing it is the single most important thing our leadership team has committed to.

The teams themselves are not the problem. They are capable, loyal people who carried a demanding two-year platform migration and know our customers better than anyone. What they have never had is a service function built around them: no service catalogue, no resolution commitments, no problem management, no owner of the customer journey between the sale and the renewal. The result is that individual effort substitutes for a system, the same issues resurface without ever being solved, and roughly 40% of what reaches our support desk are questions customers could have answered themselves if we had built the resources for them.

The Service Delivery Manager is the person who builds that function. The role reports to the CEO, sits on the leadership team, and owns the experience customers have of Medtech after the sale, across New Zealand and Australia.

- 2 -

WHY THIS IS WORTH DOING

This won’t be easy. Healthcare is complex, regulated and high-stakes. Two markets, several products, thirty years of accumulated decisions, go-lives that happen at weekends because practices cannot take downtime, and one product line still stabilising. The legacy is real.

But the people on the other end of every one of those interactions are clinicians and practice staff doing their best work for patients, often under pressure, and what they get from us shapes their day. Service is where a customer decides whether we are a supplier they tolerate or a partner they recommend. Very few organisations offer someone the chance to design a service function from first principles for 1,300 healthcare customers. This is one.

WHAT THIS ROLE DOES

Build the service management function

- Define what Medtech commits to and to whom - the service catalogue, by product, market and tier

- Set service commitments customers can hold us to, including resolution and not only response, with severity definitions that reflect clinical and operational reality

- Stand up problem management, so recurring issues get a root cause and an owner instead of another ticket

- Own the customer side of incident management - triage, escalation, major-incident communication, and a clean path into engineering

- Establish the operating cadence: daily triage, weekly service review, monthly service reporting to the executive team, quarterly improvement plan

- Instrument it - first contact resolution, resolution against commitment, backlog age, reopen rate, deflection, and the defects that reach us through support rather than by accident

Own the customer journey after the sale

- Own it end to end: onboarding, implementation, go-live, hypercare, handover to business as usual, ongoing engagement, renewal, and exit

- Own the handover gates between implementation and support, so no practice is passed on with issues nobody owns

- Introduce exit interviews and churn cause analysis. We can currently describe who leaves us; we cannot reliably say why

- Be the named escalation point when we get it wrong, and the person who fronts it with the customer

Lead the support desk

- Lead and develop the Customer Experience Team across New Zealand and Australia - first line, escalation, and application support

- 3 -

- Activate a team that is more qualified than its titles suggest; there is real clinical and technical depth on our desk that is currently under-used

- Give the team a genuine escalation route and the authority to use it. Customers tell us support feels under-empowered, and they are describing something real

- Design the self-service and knowledge experience that stops avoidable contact reaching the desk at all

Lead customer engagement and enablement

- Lead the Customer Engagement Managers - field-based training, upskilling, site visits and relationship management

- Redefine the mandate with a coverage model that states which customers see us, how often and why, and secure the investment to match it

- Build enablement that scales beyond people in cars - e-learning, in-product guidance, and training content customers can actually use

- Turn what the field learns into a signal the product organisation acts on

Own implementation delivery

- Own delivery predictability for implementations, migrations, practice mergers and greenfield installations across both markets

- Own capacity planning and effort data. Today we cannot settle a scoping question because we do not measure effort per site

- Make the delivery model sustainable. Weekend go-lives are a customer constraint; the answer is tooling and process design, not more weekends

- Own the quality gate at handover, and the issue registry that decides when a practice is genuinely live

Make the customer’s voice count

- Own the measurement system: customer NPS by market, product surveys, call sentiment and CSAT, and post-interaction feedback

- Close the loop, so customers can see what changed because they told us

- Never let a customer signal die in a queue. Our most recent product survey surfaced eleven reproducible defects that had never reached our support desk

- Partner with product and engineering so service evidence is a standing input to prioritisation, not an escalation

Use AI where it earns its place

- Own a measurable deflection and self-service target, and the capability behind it

- 4 -

- Apply AI to triage, summarisation, knowledge generation, and coaching from real customer conversations

- Hold the line on quality. A knowledge base generated from historical tickets will scale whatever answers we are already giving, so raise the standard first and then automate it

- Measure what AI changes for the customer, not what it saves us in effort

HOW YOU WILL WORK

This is a player-coach role. You will lead three experienced leaders, and you will also be in the queue, on the escalation call, on the go-live bridge at 7am on a Sunday, and in the practice when it matters. The credibility of this role is built in the work, not the title.

Work on the system, not only in it. The pattern we most need to break is capable leaders carrying load heroically and never stepping back to change the mechanism that creates it. If you take this role and simply absorb the work, we will have hired the wrong person.

Be a multiplier. Your leverage is three leaders and around twenty people who already care about our customers, and a wider business that needs to understand what service performance is telling it. Build capability, not dependency.

Acknowledge before you explain. When a customer is angry, a list of what our software can do is not an answer. They want to be heard first, then given a plan they can trust. This role sets that standard and holds everyone, including the executive team, to it.

Be commercially aware. Service performance shows up in churn, renewal and price. You should be able to speak to it in a customer renewal, in a board paper, and in a conversation about what a practice is actually paying for.

Be AI-native. Service is one of the functions AI changes most and fastest. We expect you to stay at the frontier, apply it where it improves the customer’s experience, and govern it responsibly in a clinical setting.

Be visionary when needed, pragmatic always. Service maturity is built incrementally, not in a single transformation. Set the direction clearly, then make the small, deliberate improvements that compound.

Diagnose before you solve. Our service landscape carries thirty years of decisions. Understand the system before reaching for solutions. Root causes matter more than symptoms, and first principles matter more than checklists.

Measure honestly. We would rather know a bad number than be protected from it, and we are done delaying surveys because we expect the answer to be uncomfortable. If you need the number to be good before you will look at it, this is the wrong role.

WHAT SUCCESS LOOKS LIKE AT 12 MONTHS

Working backwards from where we need to be:

- Customer NPS on a measured, improving path, tracked separately for New Zealand and Australia

- Service commitments published, including resolution times, and met - with monthly service reporting the executive team relies on

- 5 -

- First contact resolution improved and avoidable contact materially reduced against a documented baseline

- Problem management operating - recurring issues have a root cause, an owner, and a closure

- Implementation delivery predictable: committed go-live dates met, effort per site understood, and quality at handover verifiable

- Australia served to the same standard as New Zealand - coverage model live, baselines reported, no single points of failure, enablement available

- Churn causes known and feeding product, pricing and commercial decisions

- Customer problems reaching us through our own channels, rather than surfacing in a survey months later

- The three teams stable, developing, and clear about what they own, with no critical capability resting on one person

- A service roadmap the executive team can put in front of enterprise customers and health system partners with confidence

WHAT WE’RE LOOKING FOR

Essential

- 10+ years in service delivery, customer support or professional services, with at least 3 years leading at a senior level;

- Proven experience building a service function rather than inheriting one - commitments, cadence, reporting, problem management and culture introduced where they did not exist

- Experience leading managers, across locations and time zones, and developing them

- Ownership of a support function at scale - tiered support, service levels, escalation, and the tooling behind it

- Delivery credentials - you have owned implementation, onboarding or professional services delivery to committed dates

- Hands-on capability; you are comfortable doing as well as directing

- Customer-facing courage - able to sit in front of a frustrated customer, own the failure without deflecting, and be believed

- Evidence-first temperament - you will not accept “cannot replicate” as a closure when twenty customers report the same thing, and you will not accept a metric without knowing how it was measured

- Able to recognise when a software problem is a patient safety problem, and escalate it as one

- Excellent communication - able to translate service performance into business language and brief an executive team clearly

- Commercially aware - you understand how service performance shows up in churn, renewal and pricing, and can represent that in commercial conversations

- 6 -

- Applied AI in an operational or service context, and can say where it worked and where it did not

- Willing to travel regularly across New Zealand and Australia

Strong advantage

- Experience in healthcare or another regulated, high-consequence industry such as financial services or government

- Practice management, EMR or clinical software domain knowledge

- Formal service management grounding such as ITIL, held lightly - we want the discipline, not the bureaucracy

- Experience in a business running both cloud and on-premise estates

- Service design or customer experience practice exposure

- Experience with data migration or platform transition programmes

- Familiarity with modern service and telephony tooling such as HubSpot, Zendesk, ServiceNow or Dialpad

OUR PRINCIPLES

Here are the operating beliefs that shape every decision we make:

- Diagnose before you solve - understand the situation fully before reaching for a solution; root cause over symptoms

- The treasure is worth finding - hard problems are worth pursuing with conviction; believe the answer exists, even when it is not yet visible

- Meaningful work and meaningful relationships - the work matters, and so do the people doing it; we optimise for both

- Build great businesses by building great people - the quality of our people and their interactions is the engine of everything we produce

- First principles over analogy - break problems to fundamentals rather than reasoning from how others have solved it

At Medtech, we value adaptability and recognise that business needs may evolve over time. As such, this position description is subject to change.

Intermediate Accountant

Are you ready to take your accounting career to new heights? We are seeking a motivated and detail-orientated Intermediate Accountant to join our team.

We are seeking an enthusiastic and detail-oriented Intermediate Accountant to join our growing team. This role is suited to a driven professional who takes pride in delivering high-quality financial and tax services, enjoys client interaction, and is eager to contribute to the ongoing improvement of our business systems and service delivery.

Key Responsibilities

 Prepare tax returns, financial statements, and other tax-related documentation to a high standard.

 Review tax and financial documents for accuracy and compliance.

 Prepare and file GST returns for a range of clients.

 Liaise directly with clients to understand requirements and deliver tailored support.

 Follow up on new client leads and assist in client onboarding.

 Take part in special projects that enhance business processes and client experience.

 Keep current with tax legislation, accounting standards, and industry innovations.

 Collaborate with Directors and team members to help meet business objectives.

 Demonstrate initiative and maintain consistently high work standards.

 Take ownership of assigned work and maintain proactive client communication.

 Assist with other accounting and administrative tasks as needed, including financial analysis and data entry.

What We’re Looking For

 Minimum of 2–3 years of experience in a public practice accounting environment.

 Progressing toward or already completed CA/CPA qualification.

 Strong understanding of New Zealand tax law and accounting practices.

 Excellent attention to detail, communication, and time management skills.

 A proactive mindset and willingness to contribute beyond the core role.

Why Join Us?

 Join a respected firm with a strong reputation and supportive team culture.

 Gain exposure to a diverse client base with a focus on property compliance.

 Be part of a firm that values growth, innovation, and continuous improvement.

 Enjoy professional development opportunities and meaningful career progression.

Head of Security and Infrastructure

Job Details

Location Role type Work model Reports to Direct reports

Auckland Permanent, full-time Hybrid Chief Product and Technology Officer Yes

Last updated July 2026 SECURITY IS THE FOUNDATION OF HEALTHCARE TRUST. Medtech Global has spent 30 years building technology that supports clinicians across New Zealand and Australia. We have deep institutional knowledge of how healthcare actually works, and a clear-eyed view of where it needs to go. When a patient shares their health history with a clinician, they are sharing some of the most personal information about their life. They assume that it is stored securely. At Medtech, that assumption falls on us. Our software sits at the centre of clinical workflows across New Zealand and Australia. The data we handle belongs to real patients, and the clinicians relying on it are making real decisions. We are building what comes next, without stopping what works today. Security underpins both, and this role owns it - together with the infrastructure our products run on, the internal IT systems and helpdesk that keep Medtech itself running, and our privacy obligations as guardians of patient data. WHY THIS ROLE EXISTS Health systems trust us with data that is deeply personal and clinically critical. That trust has to be earned continuously, and it can be lost in a single incident. The Head of Security and Infrastructure at Medtech is the person who ensures it never is. This role sits at the intersection of technology, clinical trust, and commercial credibility. Security done well here does not just reduce risk, it opens doors. It is what allows us to enter new markets, win enterprise contracts, and keep building software that healthcare professionals can depend on. The role reports to the CPTO with a direct escalation path to the CEO on security and privacy matters - cyber risk is a standing item on the executive agenda, and the Privacy Officer's regulatory obligations are never subordinate to internal reporting lines.

- 2 -

WHY THIS IS WORTH DOING

This won't be easy. Healthcare is complex, regulated, and high-stakes. The legacy is real and the transformation ahead is significant. But the people using our software are clinicians doing their best work for patients, and the technology they work with shapes what that looks like every day.

The Head of Security and Infrastructure will help define the security, infrastructure and IT for Medtech. It is a rare opportunity. We are looking for someone who sees that clearly and wants to be part of making it real.

WHAT THIS ROLE DOES

Build and own the security programme

- Own Medtech's security posture across all products and cloud environments, from risk assessment through to driving and verifying remediation with engineering teams

- Lead the ISO 27001 / HISO 10029 programme, including scoping, gap analysis, controls implementation, and audit readiness

- Build and own the Business Continuity and Incident Response programme

- Govern vendor and third-party security obligations - access controls, cloud provider agreements, and managed security services across all third parties, including partners with access to our environments

Own the compliance programme and serve as Privacy Officer

- Lead Medtech's regulatory compliance obligations: NZ Privacy Act 2020, Health Information Privacy Code (HIPC), Australian Privacy Act, and HISO 10029 with Privacy by Design embedded from day one

- Own data sovereignty obligations across NZ and AU environments, so that patient data stays where it belongs

- Represent security and privacy in product and architecture decisions, so that new products are secure from day one, not retrofitted

- Act as Medtech's designated Privacy Officer under the NZ Privacy Act 2020 — the named point of accountability for privacy across the business

- Own the relationship with privacy regulators - the Office of the Privacy Commissioner (NZ) and the OAIC (AU) - including breach assessment and notification under both notifiable-breach regimes

- Handle privacy complaints and personal-information access and correction requests, with documented processes and timeframes

- Establish privacy impact assessments as standard practice for new products, integrations, and data flows

Embed security into how we build

- 3 -

- Shift security left into engineering practice, help with standards, tooling, and culture that make security a shared responsibility across the product and engineering organisation

- Establish a security awareness and education programme across the business, making security everyone's responsibility, with the Head of Security and Infrastructure as the standard- setter

Own the infrastructure and hosting estate

- Own the cloud hosting environments our products and customers depend on - private and public cloud, across New Zealand and Australia

- Own disaster recovery and business continuity infrastructure - architecture documented, recovery tested end-to-end, and no single person or vendor as a point of failure

- Own and govern the hosting and managed-service vendor relationships - contracts, SLAs, security obligations, performance, and genuine redundancy between providers

- Lead the internal infrastructure team and direct the managed-service partners that extend it

Lead the internal IT function

- Own and run the IT function - the tools and systems that the business depends on every day

- Lead and develop the IT team - setting direction, managing performance, and growing capability

- Own IT procurement and vendor management - selecting and managing the tools and services that keep the organisation running securely and efficiently

- Ensure IT practices meet security standards, like access management, device policies, and tooling aligned with the organisation's security posture from the ground up

- Partner with the business to understand what they need from IT and deliver it reliably

- Build the relationship with engineering, product, and executive teams so security is an enabler, not a blocker

HOW YOU WILL WORK

This is a player-coach role. You will be doing as much as directing: conducting risk assessments, writing policies, coordinating penetration testing, reviewing vendor contracts and getting into the detail of DR runbooks and hosting architecture. The credibility of this role is built in the work, not the title.

Work backwards from outcomes. Security decisions should be anchored to what they protect, what they enable, and what it costs to get them wrong. The Head of Security and Infrastructure at Medtech is not a gatekeeper, they are a strategic partner who understands the commercial and clinical stakes equally.

Be a multiplier. You will build a team, but your leverage is the security culture you embed across the whole organisation. Engineers who think about security, product managers who design it in from the start, executives who understand the risk landscape - that is the real outcome of this role.

- 4 -

Be commercially aware. Security at Medtech is a competitive differentiator. Enterprise buyers evaluate our security posture before signing. Health system contracts require demonstrable compliance. You understand this and can speak to it in the boardroom, in a sales conversation, and in a contract review.

Be AI-native. Security is changing as fast as the technology it protects. We expect you to stay at the frontier, understanding how AI changes the threat landscape, how it can accelerate security operations, and how to govern AI systems in a regulated healthcare environment.

Be visionary when needed, pragmatic always. A strong security posture is built incrementally, not in a single transformation. Set the long-term direction clearly, then make the small, deliberate improvements that compound over time. Progress is made in well-designed iterative steps.

Diagnose before you solve. Our security landscape has complexity built up over decades. Before reaching for solutions, understand the system. Root causes matter more than symptoms. First principles matter more than checklists.

WHAT SUCCESS LOOKS LIKE AT 12 MONTHS

Working backwards from where we need to be:

- ISO 27001 programme scoped and in progress, with gap analysis complete, controls roadmap agreed, certification timeline defined

- BCP/IRP operational - documented, tested, and owned

- Security standards embedded in the SDLC - engineers have guardrails to rely on, not guesswork

- Regulatory compliance posture documented and managed - NZ Privacy Act 2020, Australian Privacy Act, Health Information Privacy Code (HIPC), and HISO 10029 obligations mapped and addressed

- Vendor and third-party security obligations governed, with access controls in place and auditable

- The enterprise security risk register is actively managed, with critical risks materially reduced and progress visible to the executive and board

- A security roadmap the CPTO and executive team can present to enterprise clients and health system partners with confidence

- Disaster recovery proven - architecture documented, recovery tested, and no single person or vendor as a point of failure

- Hosting and managed-service vendor relationships under active governance - contracts, SLAs, and security obligations reviewed, with clear accountability

- Internal IT at a managed baseline with clear KPIs and goals defined - access management, device posture, and identity controls documented and auditable

- Privacy function operational - breach assessment and notification process documented and tested, access requests handled within statutory timeframes, and PIAs standard for new integrations

- 5 -

WHAT WE'RE LOOKING FOR

Essential

- 10+ years in information security, with at least 3 years in a security leadership role; a strong security manager ready to step up into their first head-of role will be considered.

- Proven experience building a security programme from scratch - policies, standards, culture, and capability; not just inheriting and maintaining

- Deep working knowledge of ISO 27001 - you have led or significantly contributed to a certification programme end-to-end

- Privacy operations experience in any regulated sector - breach assessment and notification, personal-information access requests, and privacy impact assessments; you have operated under a privacy regulator before, even if not in healthcare

- Hands-on capability - risk assessments, policy writing, penetration test coordination, security tooling; you are comfortable doing as well as directing

- Excellent communication: able to translate technical risk into business language, brief executives clearly, and build credibility with engineering teams

- Commercially aware - you understand that security posture directly affects enterprise sales, contract eligibility, and customer trust, and you can represent that in commercial conversations

- Experience owning production infrastructure or cloud operations - hosting environments, disaster recovery, and service management, ideally delivered through managed-service partners

- Proven vendor and MSP management - you have run critical operations through external partners, holding them to SLAs and security obligations

Strong advantage

- Experience in healthcare or another regulated industry such as financial services or government

- Health data literacy - working knowledge of the Health Information Privacy Code, HISO 10029, HIPPA, and how regulated health data environments work in practice

- Experience governing cloud security on Azure

- Background in security architecture - you can contribute meaningfully to architectural decisions, not just review them after the fact

- IAPP certification (CIPP/CIPM) or equivalent privacy qualification.

OUR PRINCIPLES

Here are the operating beliefs that shape every decision we make:

- Diagnose before you solve - understand the situation fully before reaching for a solution; root cause over symptoms

- 6 -

- The treasure is worth finding - hard problems are worth pursuing with conviction; believe the answer exists, even when it is not yet visible

- Meaningful work and meaningful relationships - the work matters, and so do the people doing it; we optimise for both

- Build great businesses by building great people - the quality of our people and their interactions is the engine of everything we produce

- First principles over analogy - break problems to fundamentals rather than reasoning from how others have solved it

At Medtech, we value adaptability and recognise that business needs may evolve over time. As such, this position description is subject to change.