---
title: 'Compliance Manager at Duvo Inc'
canonical: 'https://feeny.ai/job/compliance-manager-duvo-inc-europe-united-kingdom-58k5bc4cpkj7'
type: 'job'
last_seen: '2026-10-16'
---

# Compliance Manager at Duvo Inc

- **Company:** Duvo Inc
- **Location:** Europe / United Kingdom
- **Employment:** full-time
- **Work type:** remote
- **Posted:** 2026-10-02
- **Last confirmed live:** 2026-10-16
- **Apply:** https://jobs.ashbyhq.com/duvo/5271e2fe-b013-4e61-a1e5-424f3483381d

## Job description

## Who we are

Enterprise work still moves by hand: copy-pasting between spreadsheets, endless email threads, and clunky legacy UIs. We started Duvo to end that for good. We’ve already earned the trust of a range of customers, and our agents are helping them automate business-critical processes. We are growing fast, but to win from here we need exceptional people; that’s where you come in.

## What we are building

We’re building the AI operations platform for large enterprises, currently focused on retail and consumer packaged goods customers. In Duvo, customers build AI agents that execute work wherever it needs to get done—SAP, spreadsheets, supplier portals, email, APIs, you name it. Duvo is heavy on browser and computer use. In Duvo, business users specify the outcome; agents plan, act, request approvals on exceptions, and learn with every run. To help customers understand what to automate, we also help them map their processes by digesting interviews and internal documentation, which gets our foot in the door. We start with automating the parts of companies that we know best (category management, supply chain, finance ops) where we can show value fast, then expand to adjacent functions and sectors. Velocity is our moat: ship fast, iterate faster, compound learning.

## The Role

You are the function owner and, for now, its sole occupant. You report to the Head of Engineering and work daily with our Security Lead - you jointly own policies, access reviews, incident evidence and our Trust Center configuration. You are succeeding in the role when a buyer, an auditor, or a regulator’s customer can get an accurate, evidenced answer about the Duvo the first time they ask. You decide what ships in a questionnaire, whether a vendor passes review, and how the answer library is structured and governed.

## Why this role exists

Our agents hold credentials to customers' core systems and act inside them. That makes every enterprise deal a security review, and every security review a test of whether we can produce a straight, evidenced answer quickly. We hold SOC 2 Type II, ISO 27001, ISO 42001, GDPR and NIS2 commitments, and the surface keeps growing. Banks and telcos now ask about our subprocessor chain because their own regulators require it of them. This role makes Duvo reviewable. We need someone to own the answers, the evidence, the audits and the vendor chain.

## What you'll own

The Q&A library - our source of truth. Every due-diligence answer we have, mapped to ISO 27001, SOC 2, ISO 42001, NIS2 and GDPR. Each row carries an owner, approval status, evidence link, confidentiality class and review date. Fast-moving facts get reviewed monthly, process answers quarterly, stable facts annually. One version of every fact across the library, the trust center, the Trust Center portal, our policies and what engineering actually does — with write-back from every questionnaire, audit finding and product change. Customer security reviews. Intake to delivery for every customer questionnaire, tracked in our system against an agreed turnaround. Unverified answers get validated by Security, Engineering or Product before they ship, then flow back into the library. You keep the customer document set current on the public trust center and the NDA-gated Trust portal. The audit and certification programme. You run the annual calendar: SOC 2 Type II renewal, ISO 27001 and ISO 42001 surveillance, NIS2 assessment, pen test and retest, and customer right-to-audit requests. Evidence gathering, DPO and auditor liaison, findings and remediation, management assertion. Between audits you keep the ISMS and AIMS actually operating with the Security Lead: risk register, statement of applicability, policy lifecycle, access reviews, internal audit, management review, security steering cadence. Third-party and subprocessor risk. You own the vendor policy and the process behind it: intake, tiering by data access and criticality, due diligence on SOC 2 and ISO evidence, DPA terms, and zero-data-retention and no-training commitments from AI providers. Then approval, re-review, off-boarding, as required. The subprocessor list is a contractual commitment, not a page on the website. You manage review, customer notification, DPA updates and portal updates as one process.

## What we're looking for

These are the things we'll specifically evaluate you on.

- You've run a certification programme end to end. SOC 2, ISO 27001 or equivalent, through a real audit cycle - not just supported someone else's.
- You write answers that survive a hostile reviewer. Precise, evidenced, and honest about what we don't do. You know the difference between an answer and a deflection.
- Third-party risk in practice. You've built or run a vendor review process and held a subprocessor list accurate under contractual notice obligations.
- Evidence discipline. You think in terms of what an auditor will ask for in nine months, and you capture it while the work is happening rather than reconstructing it later.
- Judgement about escalation. You know which questions are yours to answer, which need Engineering or Security, and which need legal sign-off.
- You use AI tooling properly. You'll be running agents over your own workload and correcting them. Curiosity about where automation breaks is more useful here than caution about using it.
- Plain writing. Most of this job is written output read by people under time pressure.

You might also

- Have dealt with financial services or telco buyers, and know why DORA and NIS2 changed what they ask vendors for.
- Have worked on AI governance or ISO 42001 specifically.
- Have run a GRC platform Vanta, Drata, Mycroft, Segregato or similar, rather than just filled one in.
- Have sat on the vendor side of the table, as a processor answering to controllers, rather than only in-house.

This is not for you if

- You want to write policy and hand the evidence work to someone else. Here they're the same job.
- You want a team to manage. This is a sole-occupant function, and will be for a while.
- You want a predictable calendar. Scope changes when a deal stalls on it.

## How we work

These are real tradeoffs we've made, not aspirations:

- Initiative-driven. We organize around customer problems, not org charts. Problems surface through product feedback, competitive analysis, and direct customer conversations — then we prioritize, build, and ship weekly.
- Customer-obsessed. We solve real problems, not hypothetical ones. Features that don't move customer metrics get cut.
- Iterative by default. We ship small, learn fast, and never get attached to yesterday's code. This means things break sometimes — we fix forward.
- AI-first leverage. We use AI to move faster and focus human time where it matters most. If a tool can do it, a person shouldn't.
- Direct feedback. We give each other actionable feedback immediately. This can feel uncomfortable — we think that's worth it.
- Autonomy with accountability. We trust people to make decisions and hold them to outcomes, not process.

## What we offer

- Unlimited AI budget. We don't just allow AI tools — we strongly encourage them. Want to try a new tool? Buy it. Want to automate part of your workflow? Do it.
- Autonomy to do your best work. Want to meet someone to learn from? Set it up. Want a mentor? Go get one. Want to fly out to talk to an important customer? Just ask.
- A real AI product with real customers. You're not building demos or internal tools. Enterprise customers use what you ship, and their feedback drives what you build next.

## How we hire

We respect your time and aim to move fast.

- Interview with our Security Lead. (1h) What you've worked with, how you work, how you fit into this role.
- Interview with our Head of Engineering. (30 minutes) Cultural fit in line with Engineering expectation.
- Final round. Meet the team in Prague.

We aim to close the process in two weeks.

## About Duvo Inc

## Company Overview
- **One-liner**: Duvo is an agentic operations platform that maps, optimizes, and runs real-world operational workflows for retail, FMCG, and CPG companies.
- **Entity Type**: Private (Series A)
- **Headquarters**: Primarily London, UK, with a significant presence in Prague, Czechia
- **Founded**: 2025
- **Founders**: Tomáš Čupr, Marek Paris, Karel Holub, Ondřej Romancov, Simon Ammann

## Core Business
- **Primary Industries**: Enterprise AI / Operations Automation / Retail & CPG Technology
- **Target Customers**: Large retailers, FMCG (Fast-Moving Consumer Goods) and CPG (Consumer Packaged Goods) companies, multi-billion-€ enterprises
- **Mission/Purpose**: To deploy into live operations, map what is real, fix what is broken, and run the better version — bridging the gap between enterprise systems (SAP, ERP, supplier portals) and the actual work that keeps a business running.

## Products & Services
- **Duvo Platform (Agentic Operations Platform)**: A SaaS platform that maps real-world processes (using Duvo Clarity), designs improved operating models, and then runs approved workflows across SAP, ERP, supplier portals, email, spreadsheets, web tools, files, and internal systems using AI agents. It supports messy enterprise environments where APIs are incomplete by combining hosted connections, browser automation, custom MCP servers, and human approval gates. Features include RBAC, SSO, audit trails, policy gates, and human-in-the-loop review. [duvo.ai](https://www.duvo.ai/)
- **Primary Use Cases**: Supplier onboarding and compliance documentation; Purchase order creation, confirmation, and exception handling; Invoice matching, deductions, and finance operations; Inventory availability and replenishment; Price list updates and promo guardrails; Master data and SKU onboarding. [duvo.ai](https://www.duvo.ai/)

## Market Standing
- **Valuation**: Not publicly disclosed (raised $16M in December 2025)
- **Total Funding**: ~$16M (Series A, led by Index Ventures, with participation from Northzone and Credo Ventures) [duvo.ai](https://www.duvo.ai/company)
- **Key Metric**: ~€10M+ annualised impact shipped in live operations; 3 multi-billion-€ retailers in production [duvo.ai](https://www.duvo.ai/company)
- **Notable Investors/Partners**: Index Ventures (lead), Northzone, Credo Ventures [linkedin.com](https://www.linkedin.com/company/duvo-ai)
- **Growth Signals**: Founded in 2025 by the team behind Rohlík (a $1.5B grocery retailer); already has 3 multi-billion-€ retailers in production; SOC 2 Type II and ISO 27001 certified; growing headcount from ~40 people; operating across Europe and the US. [duvo.ai](https://www.duvo.ai/company)

## Competitive Advantages
- **Deep Domain Expertise**: Founders built a $1.5 billion retailer (Rohlík) — they lived the exact operational pain they now solve. They don't theorize about operations; they've been inside them at 3 AM when shipments fail [duvo.ai](https://www.duvo.ai/company).
- **Process Truth**: The platform maps what *actually* happens (not what an org chart says), including work that lives across SAP, spreadsheets, email threads, and supplier portals.
- **Full Stack Operations**: Combines process mapping, process improvement, compliance, and execution into one platform — unlike point solutions (Zapier, UiPath) or generic AI agent frameworks (LangGraph, CrewAI).
- **Enterprise Ready**: SOC 2 Type II and ISO 27001 certified with end-to-end encryption, RBAC, SSO, and audit trails — built for large, regulated retailers. [duvo.ai](https://www.duvo.ai/about-us)
- **Predictable Pricing**: One subscription — no token bills — giving customers control over what runs vs. what waits for human approval. [linkedin.com](https://www.linkedin.com/company/duvo-ai)

## Strategic Focus
- **Scaling Deployments**: Moving from 3 anchor retail customers to broader commercial expansion across Europe and the US.
- **Product Depth**: Continuing to build out the agentic operations platform, likely expanding the library of pre-built retail/CPG workflows and system integrations.
- **Hiring Builders**: Actively recruiting "operators and builders" — forward-deployed engineers, product engineers, SREs, AI platform engineers — who will deploy directly into live enterprise environments. [jobs.ashbyhq.com](https://jobs.ashbyhq.com/duvo)
- **Go-to-Market**: Building out sales, pre-sales, and partnerships teams (with roles in London and New York) to capture the large retail/FMCG/CPG automation market.

## Why Work Here
- **"Operators and Builders in the Same Room"**: Company culture emphasizes building and deploying into real, messy operations — not just building demos. The team is ~40 people across Europe and the US who "would rather deploy into a live operation than theorize about one." [duvo.ai](https://www.duvo.ai/company)
- **Remote-First (with EU/UK timezone preference)**: All 22 open roles are remote, with a base out of London (and a Prague office). Locations include London, New York, Prague, and remote across EU/UK. [jobs.ashbyhq.com](https://jobs.ashbyhq.com/duvo)
- **High Impact from Day One**: Work directly with multi-billion-€ retailers on mission-critical supply chain, finance, and logistics operations — not internal tools.
- **Fast-Growing, Well-Funded Startup**: Backed by top-tier VCs (Index Ventures, Northzone) with $16M raised in Dec 2025, giving strong runways and growth trajectory. [duvo.ai](https://www.duvo.ai/company)
- **Strong Engineering Culture**: Offers equity; competitive salaries (e.g., €110K–€220K for Product Engineers, €150K–$200K for US-based roles); roles span Product Engineering, AI Platform Engineering, Site Reliability, and Forward Deployed Engineering. [jobs.ashbyhq.com](https://jobs.ashbyhq.com/duvo)
- **Real Autonomy**: The "Team" section and job descriptions stress that you map, fix, and run — not just ticket-push. You own outcomes across the full stack.
- **Security & Compliance as a Given**: SOC 2 Type II and ISO 27001 certified — engineers build on a solid compliance foundation.

## Sources
1. [duvo.ai - Company & Careers](https://www.duvo.ai/company)
2. [duvo.ai - Product Page](https://www.duvo.ai/)
3. [duvo.ai - About Us / Security](https://www.duvo.ai/about-us)
4. [jobs.ashbyhq.com - Duvo Open Positions](https://jobs.ashbyhq.com/duvo)
5. [linkedin.com - Duvo Company Profile](https://www.linkedin.com/company/duvo-ai)

## Other roles at Duvo Inc

- [Talent Partner (EU/UK Based - Remote)](https://feeny.ai/job/talent-partner-eu-uk-based-remote-duvo-inc-london-9g1f9ymbhh3d) — London, United Kingdom
- [Junior Transformation Strategist (UK Based)](https://feeny.ai/job/junior-transformation-strategist-uk-based-duvo-inc-united-kingdom-x96bd2cn0gea) — United Kingdom
- [Product Engineer (EU/UK Based - Remote)](https://feeny.ai/job/product-engineer-eu-uk-based-remote-duvo-inc-london-4yzc5j52rj1n) — London, United Kingdom
- [Transformation Strategist (UK Based)](https://feeny.ai/job/transformation-strategist-uk-based-duvo-inc-united-kingdom-m1tchhwx0gyq) — United Kingdom
- [Senior Account Executive (EU/UK Based - Remote)](https://feeny.ai/job/senior-account-executive-eu-uk-based-remote-duvo-inc-prague-nq8krh0pbk0z) — Prague, Czech Republic
- [Pre-sales Engineer (US Based - Remote)](https://feeny.ai/job/pre-sales-engineer-us-based-remote-duvo-inc-united-states-2amf1625rtz8) — United States
- [Pre-sales Engineer (EU/UK Based - Remote)](https://feeny.ai/job/pre-sales-engineer-eu-uk-based-remote-duvo-inc-europe-united-kingdom-anf1rh31fqv7) — Europe / United Kingdom
- [Growth Generalist (US Based - Remote)](https://feeny.ai/job/growth-generalist-us-based-remote-duvo-inc-united-states-a8qbdz7za57h) — United States
- [Partner Manager (EU/UK based - remote)](https://feeny.ai/job/partner-manager-eu-uk-based-remote-duvo-inc-london-5d8n90kd6fev) — London, United Kingdom
- [Forward Deployed Engineer (UK Based)](https://feeny.ai/job/forward-deployed-engineer-uk-based-duvo-inc-united-kingdom-atatndcjdg15) — United Kingdom