Data Protection Operational Risk Manager | S3 | Compliance and Operational Risk Advisory | Milton Ke

Santander; Milton Keynes; Hybrid; GBP 54,000 - 81,000; Full time

Benefits offered by this job

Competitive rewards

Wellbeing benefits

Family leave & childcare options

Volunteering opportunities

Global growth opportunities

Job summary

Santander is seeking a Data Protection Operational Risk Manager (S3) to lead the Risk Intelligence capability within the Data Protection Office, Milton Keynes or Glasgow. You will own risk frameworks, provide independent second-line oversight, and translate data protection risk into actionable insights for governance forums.

The role requires strong operational risk expertise, familiarity with UK GDPR/PECR, and experience in data protection risk. Hybrid working and site-based duties apply.

Qualifications

• Experienced operational risk professional (Required)
• Experience in working within data protection risk (Preferred)
• Operational Risk qualification (Preferred)
• CIPP/E, CIPM (Preferred)
• Strong ability to translate risk concepts into actionable insights (Required)
• Familiarity with UK GDPR and PECR (Preferred)

Responsibilities

• Define and maintain the corporate risk appetite and strategic risk framework for Data Protection.
• Own and maintain the Data Protection Risk methodology and supporting frameworks.
• Provide independent second-line oversight and challenge of Data Protection risks and controls.
• Integrate risk metrics, DPIAs, incidents and regulatory developments into actionable insights.
• Represent the DPO at risk committees and governance forums, influencing senior stakeholders.
• Champion a robust risk culture and align with internal policies.

Skills

Operational risk concepts

Regulatory awareness

Analytical skills

Risk reporting

Stakeholder management

Data Protection risk

RCSA knowledge

Data Protection Act 2018/UK GDPR

Second-line challenge

Risk management framework

Education

Operational Risk qualification

CIPP/E

CIPM

Job description

Data Protection Operational Risk Manager | S3 | Compliance and Operational Risk Advisory | Milton Keynes or Glasgow | Internal Mobility Country: United Kingdom

IT STARTS HERE

Santander (www.santander.com) is evolving from a global, high-impact brand into a technology-driven organisation, and our people are at the heart of this journey. Together, we are driving a customer-centric transformation that values bold thinking, innovation, and the courage to challenge what's possible. This is more than a strategic shift. It's a chance for driven professionals to grow, learn, and make a real difference. Our mission is to contribute to help more people and businesses prosper. We embrace a robust risk culture and all our professionals at all levels are expected to take a proactive and responsible approach toward risk management.

Compliance and Operational Risk Advisory - Data Protection Office

THE DIFFERENCE YOU MAKE

THE DATA PROTECTION OFFICE

DATA PROTEC TION OPERATIONAL RISK MANAGER based out of MILTON KEYNES OR GLASGOW.

You will have a contributor role as Data Protection Operational Risk Manager within DPO, leading the Risk Intelligence capability and providing an independent, data-driven, evidence-led view of the Data Protection risk profile within the bank. You will be accountable for identifying emerging, deteriorating and systemic risk to inform DPO priorities, oversight and intervention. We're shaping the way we work through innovation, cutting-edge technology, collaboration and the freedom to explore new ideas. To succeed in this role, you will be responsible for:

Risk Framework & Appetite

• Define and maintain the corporate risk appetite and strategic risk framework for Data Protection, ensuring the privacy risk profile is clear, current and informs decision making.
• Own and maintain the Data Protection Risk methodology and supporting frameworks.

Oversight & Challenge

• Provide independent second-line oversight and challenge of Data Protection risks, controls, RCSAs and risk mitigation activities, ensuring risks and controls are accurately identified, appropriately owned, effectively managed, reported and reflected in RCSAs and operational reporting.

Risk Intelligence & Insight

• Integrate intelligence from risk metrics, RCSAs, DPIAs, incidents, complaints, assurance activity and regulatory developments to identify emerging, deteriorating and systemic risks, translating findings into actionable insight for the DPO, senior management and governance forums.

Governance, Escalation & Influence

• Represent the DPO the DPO at risk committees and governance forums, influencing and challenging senior stakeholders to ensure Data Protection risks are understood, managed and escalated, while strengthening risk capability across the DPO.
• Support the bank in meeting its Data Protection business, regulatory and stakeholder obligations by escalating material privacy risks and driving continuous improvement in risk management.

Risk Culture & Capability

• Championing a robust risk culture and behaviours across the team, aligned with I AM Risk..

Regulatory & Framework Compliance

• Ensure Data Protection activities remain aligned with regulatory requirements, the Enterprise-Wide Risk Management Framework and internal policies.

WHAT YOU'LL BRING

Our people are our greatest strength. Every individual contributes unique perspectives that make us greater as a team and as an organisation. We're enabling teams to go beyond by valuing who they are and empowering what they bring.

The following requirements represent the knowledge, skills, and abilities essential for success in this role. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Professional Experience

• Experienced operational risk professional (Required)
• Experience in working within data protection risk (Preferred)

Education

• Operational Risk qualification (Preferred)
• CIPP/E, CIPM (Preferred)

Hard Skills

• Excellent command of operational risk concepts and techniques, with the ability to translate them into practical, value-adding recommendations. (Required)
• Proven application of operational risk and control methodologies in complex business environments. (Required)
• Excellent awareness of regulatory and market developments and their implications for Data Protection and operational risk. (Preferred)
• Advanced analytical skills, able to synthesise multiple data sources into clear risk intelligence, trends and actionable insight. (Required)
• Credible risk subject-matter expertise, providing authoritative advice and constructive challenge to business and senior stakeholders. (Required)
• Great understanding of financial services, operational risk practices and the Data Protection regulatory environment. (Required)
• Ability to assess and articulate operational risk exposure through a robust risk management framework. (Required)
• Ability to produce concise trend analysis and risk reporting that supports senior forums, committees and decision-making. (Required)
• Great working knowledge of Risk & Control Self-Assessment (RCSA) processes and policy requirements. (Required)
• Proven ability to provide effective second-line review and challenge, including with senior management, to ensure Data Protection operational risks are appropriately reported and mitigated. (Required)
• Good working knowledge of the Data Protection Act 2018, UK GDPR and the Privacy and Electronic Communications Regulations (PECR). (Preferred)

Soft Skills

• Collaborative and inclusive, sharing insight and best practice across teams to improve collective effectiveness. (Required)
• Builds trusted relationships through respect, integrity and consistent role-modelling of Santander culture and behaviours. (Required)
• Balances risk judgement with customer and stakeholder perspectives to support proportionate, well-informed decisions. (Required)
• Partners effectively with business areas, providing clear, actionable advice and technical risk input on current and emerging issues. (Required)
• Influences with credibility and clarity, securing stakeholder understanding and buy-in for Data Protection risk priorities. (Required)

WE VALUE YOUR IMPACT

Salary Range:

£54,318.00 - £81,478.00 per annum (depending on experience)

This salary range represents the expected remuneration for the role. Annual salary is based on a standard 35-hour working week. Actual salary offered will depend on skills, experience, qualifications and location.

• Competitive rewards that reflect the real impact you make and the value you bring.
• Wellbeing that goes beyond work - we work with a range of wellbeing partners across our 4 pillars of wellbeing (physical, mental, social and financial) to give you access to a suite of apps, discounted gym and fitness access, weekly online classes, flexible healthcare and mental health support.
• Support for every life stage - from menopause and pregnancy to parenthood and beyond, with enhanced family leave, childcare options and tailored wellbeing support.
• Time to give back through volunteering opportunities that let you make a difference in the communities we serve.
• Global growth opportunities to shape your career, learn new skills and explore what's possible across our international network.

Ready to be recognised? It starts with you.

LOCAL COMPLIANCE

At Santander, we're proud to be an inclusive organisation that provides equal opportunities for everyone - regardless of age, gender, disability, civil status, race, religion or sexual orientation.

We're committed to creating a recruitment experience that's accessible, fair and welcoming for all candidates.

We want our people to thrive - at work and at home - while delivering the best outcomes for our customers and supporting each other to grow.

To make this possible, our roles are site-based with a hybrid working pattern, where colleagues are expected to attend the office at least 12 days per month (pro-rata for part-time roles).

When applying, please consider the travel distance, time and cost to your chosen office location(s).

IMPORTANT INFORMATION FOR INTERNAL APPLICANTS:

PERMANENT ROLES:

• If you are currently employed by Santander UK plc on TSB Legacy terms or by TSB and choose to apply for this Santander vacancy, please be aware that, if successful, you will move onto full Santander terms and conditions of employment and will no longer be part of the TSB Legacy population with effect from the start date of your new role.

For further Guidance please visit Internal Mobility - Candidate Guidance.

If you want to know more about the opportunity:

Please contact: Miriam Hall - [e-mail] or John Cullen: [e-mail]