Cybersecurity Manager (CTU)

Banco Santander (Brasil); Boadilla del Monte; On-site; EUR 90,000 - 120,000; Full time

Job summary

Santander IT team seeks a Cybersecurity Manager (CTU) in Madrid, leading cyber security operations for Auto Mobility Finance across multiple entities. You will oversee incidents, SIEM, and infrastructure security, driving hardening, cloud posture, and remediation initiatives.

Required are a STEM degree, 9+ years in cybersecurity, and fluent English/Spanish. The role emphasizes cross-country coordination, risk-aware decision making, and strong leadership within a global financial services context.

Qualifications

• Minimum of 9 years of experience in cybersecurity roles, with progressive responsibility in security operations, incident response, and technical leadership.
• Proven experience leading cybersecurity teams and coordinating cross-functional stakeholders in complex, multi-country environments.
• Strong background in managing security operations across large, distributed environments, ideally with exposure to financial services or similarly regulated industries.
• Experience overseeing cybersecurity projects, service improvements, and operational priorities in coordination with internal teams and external providers.
• Demonstrated ability to manage incidents, escalations, and remediation activities from identification through resolution.

Responsibilities

• Oversee cybersecurity tasks for Auto Mobility Finance units across multiple entities and countries.
• Manage cyber incidents and coordinate SOC escalations.
• Ingest, monitor, and manage SIEM logs and use cases.
• Support cyber infrastructure security and change management (firewall, WAF, proxy, antimalware, certs).
• Oversee attack surface management, ethical hacking planning, and remediation governance.
• Monitor cloud security posture and remediation tracking.
• Enforce security hardening and compliance across technologies and environments.
• Review lifecycle of secure development findings and security issues from assessments.

Job description

Cybersecurity Manager (CTU)

Country: Spain

IT STARTS HERE

Santander ( www.santander.com ) is evolving from a global, high-impact brand into a technology-driven organization , and our people are at the heart of this journey. Together , we are driving a customer-centric transformation that values bold thinking, innovation , and the courage to challenge what's possible.

This is more than a strategic shift. It's a chance for driven professionals to grow, learn, and make a real difference .

Our mission is to contribute to help more people and businesses prosper . We embrace a strong risk culture and all our professionals at all levels are expected to take a proactive and responsible approach toward risk management.

The Auto Mobility Finance business focuses on products, sales channels and commercial agreements with dealers, vehicle manufacturers or retail distribution establishments, as well as commercial functions associated with direct sales (branches, call centers or digital channels) and indirect sales (through third parties) of consumer finance products.

THE DIFFERENCE YOU MAKE

The Auto Mobility Finance division is looking for a Manager for the Cybersecurity (CTU) team based in our Boadilla del Monte (Madrid) office.

We're shaping the way we work through innovation, cutting-edge technology, collaboration and the freedom to explore new ideas. To succeed in this role, you will be responsible for:

• To do oversight the Technical tasks related to Cyber Security for all the Auto mobility finance Units under scope (aprox. 14 entities in 16 countries), and managing directly the CTU unit in SCF HQ, Western Hub and Global Services
• Cyber Incidents Management and coordination of SOC escalations.
• SIEM logs ingestion Monitoring and new configuration. Use cases management.
• Cyber Infrastructure issues support and change managemetn (FW, WAF, Proxy, Antimalware, Certs, etc)
• Attack Surface management: IFA inventory Maintenance, Ethical Hacking planning and Vulnerability remediation Management
• Cloud Security posture monitoring and management.
• Hardening Security Compliance for different technologies.
• Security Development findings review and lifecycle management.
• Cyber Intelligence feeds Monitoring and identification of main threats against SCF.

WHAT YOU'LL BRING

Our people are our greatest strength. Every individual contributes unique perspectives that make us stronger as a team and as an organization. We're enabling teams to go beyond by valuing who they are and empowering what they bring.

The following requirements represent the knowledge, skills, and abilities essential for success in this role. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Professional Experience

• Minimum of 9 years of experience in cybersecurity roles, with progressive responsibility in security operations, incident response, and technical leadership. (Required)
• Proven experience leading cybersecurity teams and coordinating cross-functional stakeholders in complex, multi-country environments. (Required)
• Strong background in managing security operations across large, distributed environments, ideally with exposure to financial services or similarly regulated industries. (Preferred)
• Experience overseeing cybersecurity projects, service improvements, and operational priorities in coordination with internal teams and external providers. (Required)
• Demonstrated ability to manage incidents, escalations, and remediation activities from identification through resolution. (Required)

Education

• Degree in a STEM-related discipline (Required)

Relevant cybersecurity certifications (Required)

Languages

• Fluent English and Spanish (Required)

Hard Skills

• Strong hands-on experience in cybersecurity operations, with a focus on Protect, Detect, and Respond capabilities, including related tools, controls, and processes. (Required)
• Solid knowledge of incident management and SOC escalation coordination , including triage, prioritization, containment, and follow-up actions. (Required)
• Experience with SIEM platforms , including log ingestion monitoring, configuration, use case management, tuning, and lifecycle maintenance. (Required)
• Proven expertise in cyber infrastructure security , including firewall, WAF, proxy, antimalware, certificate, and related security control management. (Required)
• Experience in attack surface management , including inventory maintenance, ethical hacking coordination, vulnerability tracking, and remediation governance. (Required)
• Knowledge of cloud security posture management , including monitoring, configuration review, and remediation tracking. (Preferred)
• Strong understanding of security hardening and compliance across multiple technologies and environments. (Required)
• Experience reviewing and managing the lifecycle of secure development findings and security issues raised during application or code assessments. (Preferred)
• Ability to monitor cyber intelligence feeds , assess rele