Technology & Operations Risk Manager - S3 - Chief Information & Resilience Office - Multiple Locations

Banco Santander (Brasil); Milton Keynes; On-site; GBP 70,000 - 110,000; Full time

Job summary

Santander UK is seeking a Technology & Operations Risk Manager to provide independent oversight across technology and cyber risk within the First Line of Defense. You will challenge risk assessments, help refine risk profiles, and drive improvements in governance and reporting.

The role requires strong knowledge of risk frameworks (RCSA/RCP), data analysis, and risk tooling (e.g., Heracles). Based in Milton Keynes or Glasgow, you will collaborate with cross-functional teams to maintain

Qualifications

• Experience in technology risk, cyber risk, or operational risk within financial services.
• Experience providing independent oversight or audit of control environments (2LoD or equivalent).
• Experience producing risk reporting and MI for governance forums.

Responsibilities

• Provide independent oversight and challenge of Technology & Operations risk, ensuring alignment with Operational Risk Management frameworks.
• Review and challenge Risk & Control Self-Assessments (RCSA), ensuring completeness and robust control design.
• Ensure quality and integrity of Risk & Control Profiles (RCPs), including risk identification and residual risk assessment.
• Oversee risk data in tooling (Heracles) and ensure alignment across risks, issues, events, and risk appetite statements.
• Monitor adherence to Risk Appetite Statements (RAS) and assist in breach management and remediation tracking.
• Challenge control effectiveness and identify systemic weaknesses through reviews and testing.
• Produce and analyse risk MI and reporting, noting emerging risks and trends.
• Drive continuous improvement of governance artefacts and risk engagement models across T&O.

Skills

Technology risk

Cyber risk

Operational risk

RCSA experience

Risk data analysis

Regulatory awareness

Education

Bachelor's degree in Cybersecurity/IT/Risk

CISA/CISSP/CISM certification (Preferred)

Tools

Heracles

Risk management platforms

Job description

Technology & Operations Risk Manager | S3 | Chief Information & Resilience Office | Multiple Locations

Country: United Kingdom

IT STARTS HERE

Santander (www.santander.com) is evolving from a global, high-impact brand into a technology-driven organisation , and our people are at the heart of this journey. Together , we are driving a customer-centric transformation that values bold thinking, innovation , and the courage to challenge what's possible.

This is more than a strategic shift. It's a chance for driven professionals to grow, learn, and make a real difference .

Our mission is to contribute to help more people and businesses prosper . We embrace a strong risk culture and all our professionals at all levels are expected to take a proactive and responsible approach toward risk management.

Santander Digital Services is the team of technology and operations at Santander. We are convinced of the importance of technology that is aligned with the requirements of the business and that out work not only brings value to users, people and communities but also fosters individual creativity. Our team of over 7,000 people in 8 countries (Spain, Portugal, Poland, UK, USA, Mexico, Chile and Brazil) develops and/or implements financial solutions across a broad spectrum of technologies (including Blockchain, Big Data and Angular among others) on all kinds of on-premise and cloud-based platforms.

THE DIFFERENCE YOU MAKE

Santander UK is looking for a Technology & Operations Risk Manager based out of Milton Keynes or Glasgow.

This role will provide independent oversight and challenge across technology and cyber risk, ensuring that risks are accurately identified, assessed, and managed within appetite.

This is a technically focused First Line of Defence (1LoD) role, requiring strong expertise in cybersecurity, IT risk, and control frameworks, as well as the ability to analyse risk data, challenge control environments, and drive improvements across Technology & Operations (T&O).

You will play a key role in ensuring that risk frameworks are not just followed, but are robust, data-driven, and aligned to regulatory expectations, with clear visibility of risk exposure and control effectiveness.

To succeed in this role, you will be responsible for:

• Providing independent oversight and challenge of Technology & Operations risk, ensuring alignment with Operational Risk Management frameworks.
• Reviewing and challenging Risk & Control Self-Assessments (RCSA), ensuring completeness, accuracy, and robust control design.
• Ensuring quality and integrity of Risk & Control Profiles (RCPs), including risk identification, control mapping, and residual risk assessment.
• Overseeing risk data within tooling (e.g. Heracles), ensuring alignment across risks, issues, events, and risk appetite statements.
• Monitoring adherence to Risk Appetite Statements (RAS), supporting breach management, root cause analysis, and remediation tracking.
• Challenging control effectiveness, thematic reviews, and testing outcomes to identify systemic weaknesses.
• Producing and analysing risk MI and reporting, identifying emerging risks, trends, and control gaps.
• Driving continuous improvement of governance artefacts, processes, and risk engagement models across T&O.

WHAT YOU'LL BRING

Our people are our greatest strength. Every individual contributes unique perspectives that make us stronger as a team and as an organisation. We're enabling teams to go beyond by valuing who they are and empowering what they bring.

The following requirements represent the knowledge, skills, and abilities essential for success in this role. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Professional Experience

• Experience in technology risk, cyber risk, or operational risk within financial services (Required).
• Experience providing independent oversight, challenge, or audit of control environments (2LoD or equivalent) (Required).
• Experience working with RCSA, risk frameworks, and control assessment methodologies (Required).
• Experience producing risk reporting and MI for governance forums (Required).
• Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Education

• Undergraduate degree in Cybersecurity, Information Technology, Risk, or related field (Preferred).
• Professional certifications such as CISA, CISSP, CISM, or equivalent (Preferred).

Languages

• English (Required).

Hard Skills

• Strong knowledge of cybersecurity risk, IT risk, and control frameworks (e.g. NIST, ITIL) (Required).
• Experience with risk tooling and data management (e.g. Heracles or similar platforms) (Required).
• Understanding of risk appetite frameworks, RCSA processes, and control testing methodologies (Required).
• Knowledge of technology architecture, cyber threats, and vulnerability management concepts (Required).
• Experience analysing risk data, events, and trends to id