Overview

In this role you will lead 2LoD cybersecurity risk reviews and oversight across critical domains, translating technical risk into clear governance insights for senior stakeholders. You will assess cyber risk impacts during digital transformations and business changes, ensuring appropriate controls from design to go-live. You will also strengthen third‑party risk management and analyze risk data to spot patterns and hotspots. The position sits within Santander CIB, offering exposure to complex, international projects and opportunities to shape risk governance and secure technology adoption.

Compensaciones / Incentivos

- hybrid working model
- training and certifications
- competitive rewards
- BeHealthy global wellness programme
- childcare support
- Santander Contigo employee support

Responsabilidades

- Lead 2LoD review & challenge of cybersecurity risk assessments, control evaluations, risk metrics, mitigation plans, and risk acceptances; synthesize opinions for senior stakeholders.
- Run targeted risk reviews of priority domains (IAM, network/firewall, vulnerability & patch management, cloud security, AppSec/containers, encryption/tokenization, DLP, logging/monitoring, incident response/SOC); track remediation to closure.
- Provide independent oversight on digital transformation and business change, assessing cyber risk impacts and required controls from design to go-live.




- Strengthen third-party/critical services risk management: certify services/vendors, challenge inherent risk scoring, assign residual risk ratings, and monitor remediation.
- Analyze cyber risk data (incidents, KRIs, control gaps, risk register) to identify patterns and hotspots.
- Evolve policies/frameworks to steer safe technology adoption; align to industry standards.
- Prepare governance reporting for committees and escalate issues with urgency and evidence.

Requisitos principales

- ~5–8 years in cybersecurity risk, technology risk, cyber audit or 2LoD/3LoD roles in financial services or other regulated environments.
- Bachelor’s in Computer Science, Engineering or related (Required). Master’s a plus.
- Professional certifications valued: CISA, CISM, CRISC, CISSP; plus cloud security (AWS/Azure/GCP).
- Fluent English (Required).
- Technical expertise in IAM, network/firewall management, vulnerability/patch management, cloud security, secure SDLC & containerization, encryption/tokenization, DLP, logging & monitoring, incident detection & response, and offensive security understanding.
- Familiarity with NIST CSF, ISO 27001/22301, COBIT, SOC 2/ISAE 3000, OWASP; experience executing cyber risk oversight programs in 2LoD/3LoD.

- Strong risk judgment
- Effective documentation
- Cross‑team coordination
- IAM
- network & firewall management
- vulnerability/patch management

📌 Risk Technology Risk & Cybersecurity Specialist III (Boadilla del Monte)
🏢 Grupo Santander
📍 Boadilla del Monte