Healthcare Data Risk & Compliance Lead

Birdie; Greater London; Hybrid; GBP 70,000 - 85,000; Full time

Benefits offered by this job

Generous stock options

Bi-annual performance reviews

Learning budget and mentorship

Hybrid working in London HQ

Home workspace budget

33 days holiday (25 days + holidays)

Birthday day off

Company shutdown between Christmas and

2 volunteering days

Private health insurance

Pension 4% employer

Job summary

Birdie is hiring a Risk & Compliance Manager to define, embed, and monitor compliance across data protection, information security, and healthcare governance. You will oversee NHS DSPT, DSCR, GP Connect, and PDS requirements, collaborating with engineering, product, and legal teams under our GC and external DPO.

You will drive data protection programs, maintain risk registers, and lead incident response while shaping a proactive, risk-aware culture across tech and go-to-market teams.

Qualifications

• Experience implementing NHS DSPT, DSCR and NHS API assurance (GP Connect, PDS).
• Strong knowledge of UK GDPR and Data Protection Act 2018 in SaaS environments.
• Led risk assessments, control design, and maintained a business risk register with external DPO or legal counsel.

Responsibilities

• Own data protection compliance across product and operations, coordinating with external DPO on DPIAs and information rights.
• Lead annual NHS DSPT submission and maintain Standards Met status; align with DSCR and clinical risk (DCB0129/0160).
• Ensure NHS interoperability connections (GP Connect, PDS, etc.) meet data flow standards.
• Maintain Birdie's risk register and run third-party risk assessments and audits.
• Lead incident response for data protection/compliance breaches from root-cause to remediation.
• Develop KRIs/KPIs for leadership and governance across tech and GTM teams.

Skills

Data protection

NHS DSPT

DSCR

UK GDPR

Risk management

Policy drafting

Education

CIPP/E

CIPM

CISM

CISA

Job description

Birdie is hiring a Risk & Compliance Manager to define, embed, and monitor compliance across data protection, information security, and healthcare governance. You will oversee NHS DSPT, DSCR, GP Connect, and PDS requirements, collaborating with engineering, product, and legal teams under our GC and external DPO.

You will drive data protection programs, maintain risk registers, and lead incident response while shaping a proactive, risk-aware culture across tech and go-to-market teams.