If everything other than \theta (or the additive f) is input data, f(\theta) is affine; therefore norm((f(\theta)) is convex and is allowed by CVX, and square_pos(norm(f(\theta))) is also convex and is allowed by CVX.
If something other than \theta or f s an optimization variable, or some function (expression) of optimization variables, then we would need to know what those exact relations are in order to make that determination.
In the future, you should be telling whether something is convex, not asking us, as discussed in Why isn't CVX accepting my model? READ THIS FIRST! .