Information Security Manager - Compliance & Data Protection
About the job
- At least 5 years of combined information technology and information security or governance, risk, and compliance experience, ideally in an environment handling sensitive client data.
- Strong practical knowledge of the General Data Protection Regulation and United Kingdom General Data Protection Regulation, including day-to-day data protection and cross-border data transfer complexities.
- Hands-on experience with International Organization for Standardization 27001 and/or Service Organization Control 2 implementation and audits.
- Core information technology administration abilities, including hands-on technical support.
- Working familiarity with the Microsoft 365 security stack, including Entra ID, Microsoft Defender, Microsoft Purview, and Intune.
- Experience responding to client or customer security assessments and questionnaires.
- Artificial intelligence fluency and day-to-day use of automation tools.
- Based in the United Kingdom with the right to work, ideally in or near London.
- Ability to communicate security and risk clearly in plain business language to leadership, clients, and colleagues.
- Own and run the firm's information security programme end-to-end.
- Conduct a comprehensive audit of the firm's global security posture and translate findings into a prioritized remediation roadmap.
- Define, maintain, and operationalize security policies, standards, and procedures.
- Maintain the risk register, run regular risk assessments, and drive remediation to closure.
- Report on security and compliance posture to leadership in clear, business-oriented terms.
- Audit the firm's compliance posture with a focus on General Data Protection Regulation readiness and build a path to audit readiness.
- Support the Service Organization Control 2 Type 2 and Health Insurance Portability and Accountability Act certification process for Twine.
- Track relevant regulatory and framework developments and translate them into practical action.
- Serve as the firm's designated European Union Data Protection Officer.
- Lead data protection under the General Data Protection Regulation and United Kingdom General Data Protection Regulation, including cross-border transfers between the European Union, United Kingdom, and United States.
- Audit how client information flows across jurisdictions and close data-classification gaps.
- Maintain records of processing, conduct Data Protection Impact Assessments, and own data-handling, retention, and minimization policies.
- Manage data subject requests and personal-data incidents, including required regulator and individual notifications.
- Identify and address data-protection risks across business functions.
- Own responses to client security due diligence, including security questionnaires and assessments.
- Support commercial and contractual discussions concerning security, privacy, and data-processing terms.
- Maintain reusable security documentation, certifications, and answers for client reviews.
- Secure and govern the Microsoft 365 E5 environment, including Entra ID, Microsoft Defender, Microsoft Purview, and Intune.
- Own identity and access management, including conditional access, multifactor authentication rollout, privileged access, joiner/mover/leaver processes, and least-privilege enforcement.
- Implement and tune data-loss prevention, information protection and labeling, and device compliance.
- Partner with information technology on secure configuration, patching, and endpoint hardening.
- Provide hands-on information technology support for the European Operations team, including on-site technical assistance when needed.
- Act as the day-to-day technology point of contact for European colleagues.
- Run third-party and vendor risk management across the supply chain, including security reviews of new tools and artificial-intelligence or software-as-a-service vendors.
- Maintain a vendor inventory and reassess vendor risk regularly.
- Own and update the incident-response plan and lead detection, triage, investigation, containment, and post-incident review.
- Investigate security events, including analysis of Entra ID sign-in and audit logs, and produce actionable incident reports.
- Run tabletop exercises.
- Build and deliver security-awareness training and phishing simulations.
- Experience standing up or maturing a security and compliance programme.
- Experience serving as or supporting a Data Protection Officer function.
- Familiarity with European Union and United Kingdom regulatory developments such as NIS2 and DORA.
- Experience managing third-party or vendor risk for software-as-a-service and artificial-intelligence tooling.
- Exposure to life sciences or pharmaceutical environments and awareness of GxP, GDP, or healthcare-data considerations, including HIPAA for United States-facing work.
- Experience establishing data-protection or data-risk practices.
- Experience supporting mergers and acquisitions or subsidiary integration from a security and compliance perspective.
- Relevant certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified Information Systems Auditor, Certified in Risk and Information Systems Control, ISO 27001 Lead Implementer or Auditor, Certified Information Privacy Professional/Europe, or Certified Information Privacy Manager.
About the company
Blue Matter is a specialized management consulting firm focused on life sciences. It works with bio-pharmaceutical clients to address strategic issues across the company and product value chain, providing insights to help leaders create and achieve their visions. The firm emphasizes a client-centered, customized approach, matching staffing to each engagement to ensure desired results. Its team consists of experienced strategy consultants with deep life-science expertise who collaborate with senior leaders to deliver innovative and actionable solutions. Blue Matter aims to help life science companies shape great ideas, products, and companies by delivering practical strategies and plans that drive growth and value.
Company Size
201-500
Company Stage
N/A
Total Funding
N/A
Headquarters
South San Francisco, California
Founded
2012
Get referred to Blue Matter
See people who can refer or advise you
Simplify's Take
What believers are saying
- Blue Matter launched R&D, policy, and People and Organization practices in 2026.
- Baird Capital reinvested in April 2026, signaling confidence and fresh growth capital.
- Blue Matter keeps hiring partners in Europe, expanding client coverage beyond San Francisco.
What critics are saying
- Precision Medicine Group's trade-secret trial against Blue Matter was active in March 2026.
- Blue Matter's acquisitions force integration risk across AIM, Sam Brown, and Spekle by 2026.
- If Baird exits again without buyers, Blue Matter loses sponsor-backed acquisition currency quickly.
What makes Blue Matter unique
- Blue Matter serves top-20 biopharma clients across strategy, R&D, policy, and communications.
- Baird Capital says Blue Matter tripled revenue since 2020 through acquisitions and organic growth.
- Blue Matter retains majority management ownership after Baird's April 2026 continuation vehicle.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Wellness Program
Gym Membership
Hybrid Work Options
Professional Development Budget
Mentorship Program
Growth & Insights and Company News
6 month growth
35%1 year growth
35%2 year growth
38%Prevent Cancer Foundation Annual Gala, sept. 16, 2026. September 16, 2026 Blue Matter will be supporting the Prevent Cancer Foundation's Annual Gala in Washington, D.C. This popular event attracts more than 1,000 guests from the biopharma industry, as well as diplomatic, government, medical, philanthropic, sports, and social communities. Blue Matter Partners, Milena Sullivan and Mary Roberts will be in attendance. Want to Join Its Team? Learn about Blue Matter's innovative work experiences, enriching development opportunities, team-oriented "People First" culture, and a lot more. Need help? Contact Blue Matter Consulting today. Blue Matter Consulting is excited to learn about your strategic business objectives and brainstorm how to help you achieve them.
Blue Matter: mastering the business of science with intelligent automation. In the ecosystem of life sciences, Blue Matter (BM) has carved out a reputation for excellence. As a premier strategic advisor to the industry's titans, serving nearly all of the top 20 global biopharmaceutical companies, BM guides clients through the labyrinth of drug development, from oncology launch strategies to the commercialization of rare disease therapies. Their work influences decisions worth billions of dollars and impacts the trajectory of life-saving treatments. However, rapid global expansion brought BM face-to-face with a challenge common to elite professional services firms: while their front-end delivery was cutting-edge, their back-office operations were tethered to manual, labor-intensive processes. As the firm grew across the United States, Europe and Asia, the process of translating complex client contracts into financial reality, the "Contract-to-Cash" lifecycle, became a source of friction. Recognizing that operational drag could eventually threaten strategic agility, BM partnered with Initus Technologies. Their goal was to fundamentally transform their financial operations into a strategic asset. The result is a system that leverages InitusIDP and InitusIO to master complexity, delivering operational velocity and unlocking deep business intelligence. The context: the unique complexity of biopharma consulting. To understand the magnitude of the challenge, one must understand the unique nature of BM's engagements. In the life sciences sector, consulting agreements are rarely simple time-and-materials arrangements. They are sophisticated financial instruments tied to the volatile milestones of drug development. A single Statement of Work (SOW) might contain multi-year billing schedules contingent on regulatory gates (e.g., "Upon FDA Phase II Submission"), clinical trial completions, or commercial launch dates. Furthermore, the procurement departments of global pharma giants are notoriously rigid; a single discrepancy between a Purchase Order (PO) number on an invoice and the client's system can result in payment rejections and months of delays. The challenge: the friction of scale. For BM's finance team, managing this complexity manually was becoming unsustainable. The "Contract-to-Cash" process relied on highly skilled staff acting as data scribes, painstakingly deciphering pages of unstructured SOWs and manually keying billing milestones into Oracle NetSuite. This manual workflow introduced three critical risks: * Operational Latency: There was a significant lag between a "Verbal Win" in the CRM (Salesforce) and the project setup in the ERP (NetSuite). This delayed resource allocation and time tracking, creating a disconnect between the consulting teams and the financial ledger. * Financial Risk: The manual entry of complex billing rules and PO details increased the likelihood of human error. In an industry where invoice accuracy is paramount, these errors threatened to extend Days Sales Outstanding (DSO) and impact liquidity. * Strategic Blindness: Perhaps most critically, valuable data was being left on the table. While the finance team knew who they were billing, the granular details of what they were billing, specific therapeutic areas, drug names, and clinical phases, remained locked inside PDF documents. This "dark data" was inaccessible for high-level strategic analysis and valuation. The solution: an architecture of "Decoupled Intelligence" BM and Initus engineered a solution based on a philosophy of "Decoupled Intelligence". Rather than building a rigid integration that would break under the weight of varied contract formats, the team deployed a flexible, AI-driven architecture utilizing two core Initus technologies. 1. InitusIDP: The AI-Powered "Universal Translator" The core innovation was training the InitusIDP (Intelligent Document Processing) engine to read and understand BM's specific contract structures. InitusIDP now acts as a universal translator for the business. It ingests unstructured SOWs and Purchase Orders, intelligently parsing complex billing tables and extracting critical metadata. It understands context, identifying that a specific date and amount correspond to a "Phase III Completion" milestone and structuring that data for the ERP. 2. InitusIO: Orchestrating the "Verbal Win" Velocity To eliminate operational latency, InitusIO (the Integration Platform) introduces a seamless "Verbal Win" workflow. The moment a deal is verbally agreed upon in Salesforce, InitusIO triggers the instantaneous creation of a "Shell Project" in NetSuite. This effectively decouples the operational start of a project from the administrative completion of the contract. Delivery teams can begin tracking time and resources immediately, while the AI processes the paperwork in parallel. Once the contract is fully executed, InitusIO automatically "hydrates" this shell project with the precise billing rules extracted by InitusIDP, converting it into a revenue-generating asset without a single manual keystroke. 3. Unlocking the "Dark Data" of Strategy Beyond operational speed, the project addressed a key strategic directive from BM's leadership: Business Intelligence. InitusIDP was designed to extract not just financial data, but strategic metadata, Drug Names, Therapeutic Areas (e.g., Oncology, CNS), and Clinical Phases. Crucially, the project included a strategic initiative to backfill this data from historical contracts dating back to 2021. This turned the firm's document archive into a structured database, allowing leadership to analyze revenue concentrations by disease area or drug stage, rather than just by client revenue. The impact: from administrative burden to strategic advantage. The transformation has fundamentally altered Blue Matter's operational DNA, delivering value across three key dimensions: * Operational Velocity: The time required to set up complex, multi-milestone projects has collapsed from days of back-and-forth to minutes of automated processing. The finance team has shifted from data entry to exception management, focusing their expertise on high-value analysis rather than transcription. * Financial Integrity: The system acts as a digital guardian for cash flow. By automatically validating Purchase Order details against SOWs before a project is even active, InitusIO prevents revenue leakage and ensures that every invoice generated matches the client's strict procurement requirements, safeguarding the firm's liquidity. * Valuation and Visibility: The most profound impact is the clarity BM now possesses regarding its own market position. With a structured historical dataset linking revenue to specific therapeutic niches, BM can articulate its value proposition with empirical precision. This data is a critical asset for internal valuation and strategic planning, proving the firm's dominance in high-value segments like Oncology and Rare Diseases. A foundation for future growth. Blue Matter's journey demonstrates that true digital transformation is about reimagining it. By leveraging the combined power of InitusIDP and InitusIO to master the complexity of their contracts, BM has built a digital backbone that is as sophisticated as the strategic advice they provide to the world's leading pharmaceutical companies. They have not only solved an operational bottleneck but have also laid the foundation for a future where their operations are as agile, intelligent, and impactful as their consulting. Appendix: stakeholder perspectives. Quotes from Adam Pennington, Director of FP&A and Operations On Risk management: "In our industry, a single discrepancy on a Purchase Order can delay payment by months. InitusIDP understands the rigid procurement requirements of our pharma clients, ensuring we bill exactly what the client expects to pay." Adam Pennington Director of Finance, Blue Matter Consulting On partnership: "What impressed me most was the architectural approach. With the Initus team, we built a solution that handles the reality of real-world contracts without compromising the integrity of our financial ledger. It's flexible, robust and completely scalable." Adam Pennington Director of Finance, Blue Matter Consulting
Eva officially joined the Blue Matter team on September 16, bringing a broad base of strategic consulting experience across pharmaceutical, biotech, and medical technology clients.
Sam Brown Healthcare Communications, a Blue Matter Company, is proud to announce the appointment of Michael Heinley to the new position of Managing Director, Client Development and Engagement, reporting to Founder and President Laura Liotta.
NEW YORK and DÜSSELDORF, Germany, Dec. 2, 2024 /PRNewswire/ - Blue Matter is pleased to announce that Deepak Veeraraghavan has joined as a Partner based in Düsseldorf, Germany.