Data Protection Operational Risk Manager | S3 | Compliance and Operational Risk Advisory | Milton Keynes or Glasgow | Internal Mobility
Description
IT STARTS HERE
Santander () is evolving from a global, high-impact brand into a technology-driven organisation, and our people are at the heart of this journey. Together, we are driving a customer-centric transformation that values bold thinking, innovation, and the courage to challenge what’s possible.
This is more than a strategic shift. It’s a chance for driven professionals to grow, learn, and make a real difference.
Our mission is to contribute to help more people and businesses prosper. We embrace a robust risk culture and all our professionals at all levels are expected to take a proactive and responsible approach toward risk management.
Compliance and Operational Risk Advisory – Data Protection Office
THE DIFFERENCE YOU MAKE
THE DATA PROTECTION OFFICE is recruiting a DATA PROTEC
TION OPERATIONAL RISK MANAGER based out of MILTON KEYNES OR GLASGOW.
You will have a contributor role as Data Protection Operational Risk Manager within DPO, leading the Risk Intelligence capability and providing an independent, data-driven, evidence-led view of the Data Protection risk profile within the bank. You will be accountable for identifying emerging, deteriorating and systemic risk to inform DPO priorities, oversight and intervention. We’re shaping the way we work through innovation, cutting-edge technology, collaboration and the freedom to explore new ideas. To succeed in this role, you will be responsible for:
Risk Framework & Appetite
- Define and maintain the corporate risk appetite and strategic risk framework for Data Protection, ensuring the privacy risk profile is clear, current and informs decision making.
- Own and maintain the Data Protection Risk methodology and supporting frameworks.
Oversight & Challenge
- Provide independent second-line oversight and challenge of Data Protection risks, controls, RCSAs and risk mitigation activities, ensuring risks and controls are accurately identified, appropriately owned, effectively managed, reported and reflected in RCSAs and operational reporting.
Risk Intelligence & Insight
- Integrate intelligence from risk metrics, RCSAs, DPIAs, incidents, complaints, assurance activity and regulatory developments to identify emerging, deteriorating and systemic risks, translating findings into actionable insight for the DPO, senior management and governance forums.
Governance, Escalation & Influence
- Represent the DPO the DPO at risk committees and governance forums, influencing and challenging senior stakeholders to ensure Data Protection risks are understood, managed and escalated, while strengthening risk capability across the DPO.
- Support the bank in meeting its Data Protection business, regulatory and stakeholder obligations by escalating material privacy risks and driving continuous improvement in risk management.
Risk Culture & Capability
- Championing a robust risk culture and behaviours across the team, aligned with I AM Risk..
Regulatory & Framework Compliance
- Ensure Data Protection activities remain aligned with regulatory requirements, the Enterprise-Wide Risk Management Framework and internal policies.
WHAT YOU’LL BRING
Our people are our greatest strength. Every individual contributes unique perspectives that make us greater as a team and as an organisation. We’re enabling teams to go beyond by valuing who they are and empowering what they bring.
The following requirements represent the knowledge, skills, and abilities essential for success in this role. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Professional Experience
- Experienced operational risk professional (Required)
- Experience in working within data protection risk (Preferred)
Education
- Operational Risk qualification (Preferred)
- CIPP/E, CIPM (Preferred)
Hard Skills
- Excellent command of operational risk concepts and techniques, with the ability to translate them into practical, value-adding recommendations. (Required)
- Proven application of operational risk and control methodologies in complex business environments. (Required)
- Excellent awareness of regulatory and market developments and their implications for Data Protection and operational risk. (Preferred)
- Advanced analytical skills, able to synthesise multiple data sources into clear risk intelligence, trends and actionable insight. (Required)
- Credible risk subject-matter expertise, providing authoritative advice and constructive challenge to business and senior stakeholders. (Required)
- Great understanding of financial services, operational risk practices and the Data Protection regulatory environment. (Required)
- Ability to assess and articulate operational risk exposure through a robust risk management framework. (Required)
- Ability to produce concise trend analysis and risk reporting that supports senior forums, committees and decision-making. (Required)
- Great working knowledge of Risk & Control Self-Assessment (RCSA) processes and policy requirements. (Required)
- Proven ability to provide effective second-line review and challenge, including with senior management, to ensure Data Protection operational risks are appropriately reported and mitigated. (Required)
- Good working knowledge of the Data Protection Act 2018, UK GDPR and the Privacy and Electronic Communications Regulations (PECR). (Preferred)
Soft Skills
- Collaborative and inclusive, sharing insight and best practice across teams to improve collective effectiveness. (Required)
- Builds trusted relationships through respect, integrity and consistent role-modelling of Santander culture and behaviours. (Required)
- Balances risk judgement with customer and stakeholder perspectives to support proportionate, well-informed decisions. (Required)
- Partners effectively with business areas, providing clear, actionable advice and technical risk input on current and emerging issues. (Required)
- Influences with credibility and clarity, securing stakeholder understanding and buy-in for Data Protection risk priorities. (Required)
WE VALUE YOUR IMPACT
At Santander, your contribution matters. We recognise the difference you make every day, and we make sure you feel valued, supported and rewarded in return.
Here, recognition goes beyond pay. It’s about the pride you feel in your work, the impact you have on customers and communities, and the opportunities you have to grow and thrive — personally and professionally.
Salary Range:
£54,318.00 - £81,478.00 per annum (depending on experience)
This salary range represents the expected remuneration for the role. Annual salary is based on a standard 35-hour working week. Actual salary offered will depend on skills, experience, qualifications and location.
- Competitive rewards that reflect the real impact you make and the value you bring.
- Wellbeing that goes beyond work — we work with a range of wellbeing partners across our 4 pillars of wellbeing (physical, mental, social and financial) to give you access to a suite of apps, discounted gym and fitness access, weekly online classes, flexible healthcare and mental health support.
- Support for every life stage — from menopause and pregnancy to parenthood and beyond, with enhanced family leave, childcare options and tailored wellbeing support.
- Time to give back through volunteering opportunities that let you make a difference in the communities we serve.
- Global growth opportunities to shape your career, learn new skills and explore what’s possible across our international network.
Ready to be recognised? It starts with you.
LOCAL COMPLIANCE
At Santander, we’re proud to be an inclusive organisation that provides equal opportunities for everyone — regardless of age, gender, disability, civil status, race, religion or sexual orientation.
We’re committed to creating a recruitment experience that’s accessible, fair and welcoming for all candidates.
We want our people to thrive — at work and at home — while delivering the best outcomes for our customers and supporting each other to grow.
To make this possible, our roles are site-based with a hybrid working pattern, where colleagues are expected to attend the office at least 12 days per month (pro-rata for part-time roles).
When applying, please consider the travel distance, time and cost to your chosen office location(s).
IMPORTANT INFORMATION FOR INTERNAL APPLICANTS:
PERMANENT ROLES:
- If you are currently employed by Santander UK plc on TSB Legacy terms or by TSB and choose to apply for this Santander vacancy, please be aware that, if successful, you will move onto full Santander terms and conditions of employment and will no longer be part of the TSB Legacy population with effect from the start date of your new role.
WHAT TO DO NEXT
If this sounds like a role you are interested in, then please apply.
For further Guidance please visit Internal Mobility - Candidate Guidance.
If you want to know more about the opportunity:
Please contact: Miriam Hall – miriam.hall@santander.co.uk or John Cullen: John.cullen@santander.co.uk
#LI-DNI