Manager: Compliance Advisory and Data Protection

Griffin Bank Ltd; United States; Remote; USD 107,000 - 120,000; Full time

Benefits offered by this job

Remote-first UK

Private medical with family cover

Pension: Auto-enrolment

Share options: own a part of what wee

Flexible working

Job summary

Griffin is a fully regulated UK bank powering the accounts and payments offerings of fintechs and platforms. We are a remote-first team seeking a Data Protection Officer to shape our data governance, DPIAs, TRAs, and ICO engagement, reporting to the COO, with independence to define the role as we scale.

Join a fast-growing organization that emphasizes clear writing, practical regulatory translation, and collaboration across product, sales and operations to protect customer data and outcomes.

Qualifications

• Compliance experience in the first (preferred) or second line of a UK regulated firm, ideally a bank, e-money institution or payments firm.
• Practical knowledge of the rules behind our products, like Consumer Duty, BCOBS, CASS, FISMA, the Payment Services Regulations and the Money Laundering Regulations. Familiarity with HMRC requirements like BBSI and AEOI reporting.
• Expert knowledge of data protection law and practice, including the UK GDPR, the Data Protection Act 2018, PECR and the Data (Use and Access) Act 2025.
• Hands‑on experience turning regulation into practical requirements for product, sales or operations teams.
• A curious, questioning approach. You know the right questions to ask before signing something off, not just the rules to check it against.
• The confidence to challenge, clearly and kindly, when something isn't right.
• A love of writing. We have a major amount of written documentation that you will be contributing to, and we place a high degree of importance on clarity and readability.

Responsibilities

• Product development: translate regulation into clear requirements and compliant product launches.
• Product lifecycle management: keep live products compliant through periodic assessments and monitoring.
• Sales: check early whether potential partners fit risk appetite and review sales material.
• Marketing: ensure promotions comply with regulation and policies.
• Service (Operations): embed regulatory and data protection into day-to-day workflows with controls.
• Regulatory change: interpret new rules and coordinate timely changes.
• Issues and reporting: investigate and fix compliance issues and report risks clearly.
• Working with second line (Protect): bring them in early and act on their challenges.
• Data protection: act as DPO, with DPIAs, TRAs, training, and ICO liaison.

Skills

Compliance experience

First line experience

Second line experience

UK regulated bank

Payments experience

Data protection knowledge

Strong writing

Communication

Job description

Hi, we're Griffin. We're a fully regulated UK bank that powers the accounts and payments offerings of product-led fintechs and platforms like Uber, Yonder, Prosper, and Sidekick. By doing the heavy lifting behind the scenes, our customers can focus on what they do best - delivering amazing customer experiences. We've grown rapidly since our launch in 2024, and today provide the banking backbone behind products in remittance, payroll, wealth, insurance, proptech, payments, neobanking and more. We're moving into card issuing, stablecoin infrastructure, and agentic finance next as we continue to support the next generation of product-led companies., You'll join our Service guild and work across first line operations, sales and produt. Working closely with Protect (our second line) you'll be the first person dedicated to compliance within the team. You'll define what great compliance solutions look like. Then implement them , keeping Griffin's products and customer outcomes in shape as we grow., In your first year, you've taken ownership of our data protection agenda. You've gone looking for ways to improve, made the changes happen, and given our senior leaders an honest picture of where we stand. You've sought out our operations, sales and product teams and shown them that working with you makes things smoother, not slower. Now they bring you in early by default. You've guided at least one major launch, like card issuing, from first idea to go live. And you've put clear governance and outcome monitoring in place for our live products, so Protect (our second line risk and compliance team) sees fewer surprises and finds a stronger compliance foundation.,

• Product development: turning regulation into clear requirements, customer journeys, T&Cs and fair value assessments, from first idea through product approval to launch, with data protection built in from the start.
• Product lifecycle management: keeping live products compliant through periodic fair value assessments, outcome monitoring, reviews, changes and closures.
• Sales: helping our commercial team check early whether potential partners fit our risk appetite, and reviewing sales material.
• Marketing: working on marketing materials, both ours and our customers', to make sure they comply with regulation and our own policies, and that our financial promotions are properly challenged.
• Service (Operations): building regulatory and data protection requirements into how Service works day to day, with procedures and controls people actually use.
• Regulatory change: working out what new rules mean for us, and making sure the right teams make the right changes on time.
• Issues and reporting: investigating and fixing compliance issues, including personal data breaches, and reporting clearly on compliance risks and customer outcomes.
• Working with second line (Protect): bringing them in early, sharing the evidence they need, and acting on their challenge.
• Data protection: being our Data Protection Officer (DPO), which means:
  + advising our teams on their obligations, including data protection impact assessments (DPIAs) and transfer risk assessments (TRAs) + monitoring and auditing how well we comply with the UK GDPR, other data protection laws and our own policies + training colleagues and raising awareness of data protection + being our contact point for the ICO and for people with questions or requests about their data As our DPO, you'll report directly to our COO and have the independence you need to do the job well. We'll involve you early in anything that affects personal data. We expect you to shape this role: This description reflects what we need today. How you achieve these outcomes, where you focus your energy, how this role evolves is for you to define as you learn what our customers need and where our technical gaps are.

As our DPO, you'll report directly to our COO and have the independence you need to do the job well. We'll involve you early in anything that affects personal data. We expect you to shape this role: This description reflects what we need today. How you achieve these outcomes, where you focus your energy, how this role evolves is for you to define as you learn what our customers need and where our technical gaps are.

We need a proactive doer. You get stuck in without waiting to be asked, and you're comfortable tackling regulations you haven't met before. You use your experience and expertise to help our teams find simple, clear and compliant solutions. Your advice is balanced, easy to follow and focused on the risks that matter most. You want to push the business forward, and you see good compliance as part of how we get there. To ensure this, we're looking for people who have:

• Compliance experience in the first (preferred) or second line of a UK regulated firm, ideally a bank, e-money institution or payments firm.
• Practical knowledge of the rules behind our products, like Consumer Duty, BCOBS, CASS, FISMA, the Payment Services Regulations and the Money Laundering Regulations. As well as familiarity with HMRC requirements like BBSI and AEOI reporting.
• Expert knowledge of data protection law and practice, including the UK GDPR, the Data Protection Act 2018, PECR and the Data (Use and Access) Act 2025.
• Hands‑on experience turning regulation into practical requirements for product, sales or operations teams.
• A curious, questioning approach. You know the right questions to ask before signing something off, not just the rules to check it against.
• The confidence to challenge, clearly and kindly, when something isn't right.
• A love of writing. We have a major amount of written documentation that you will be contributing to, and we place a high degree of importance on clarity and readability (you can find out more here about how we write).

Ideally, you would also:

• Have deep expertise in at least one specialist area, such as payments, cards, Consumer Duty, BCOBS, financial promotions or similar.
• Have been a DPO, or worked closely with one, in a regulated firm.
• Have worked in finance or banking.

We believe that smart, motivated, conscientious people thrive in high-trust, high-autonomy environments and have done our best to create such an environment at Griffin. People who thrive here don't require much hand-holding, and go out of their way to figure out how to contribute in the most valuable way possible.

We've been remote-first since we were established in 2017 and we remain so today. Work here is asynchronous and fully flexible - because we want to be a part of your life in a way that helps you to get the most out of both your work and home life. We understand that our culture and ways of working aren't for everyone, and we're very intentional about our hiring process as a result. We won't hire people who don't seem like a strong fit for our core values, even if they're otherwise extremely qualified. Our strong culture has helped us to remain a mission‑driven company as we have scaled, and gives our people a clear, explicit operating framework and the space to focus on delivering real value for our customers.

We are an early stage startup and we're working hard to expand our benefits package. We're planning to add to this list in the future.

• Salary: £ 80-90 (DOE)
• Remote-first flexibility: Work from anywhere in the UK
• Work from abroad: Up to 20 days a year
• Time off: 25 days' holiday, bank holidays and a winter break (we shut down between Christmas and New Year)
• Share options: Own a part of what we're building together
• Pension: Auto-enrolment into our Penfold scheme
• Insurance: Private medical with Bupa (including family cover) and life insurance with AIG
• Wellbeing: 1:1 coaching and therapy session available through Oliva
• Family leave: Enhanced parental leave with up to 6 months on full pay after two years' service
• AI tools: Everyone has a Claude subscription on us and access to other premium tools
• Your setup: We'll support you in creating a comfortable and effective WFH environment.