Risk & Compliance Manager

Who you are

• You have strong familiarity with NHS DSPT, DSCR, and NHS API assurance frameworks (GP Connect, PDS)
• You know UK GDPR and the Data Protection Act 2018 inside out, and can apply it practically in a fast-moving SaaS environment
• You've led or played a major role in risk assessments, control design, and managing a business risk register - ideally alongside an external DPO or legal counsel
• You can turn complex legal and health-system regulations into clear, actionable requirements for engineers and product teams
• You write and speak with clarity, whether it's a policy, an executive report, or team training
• You have sound judgment and the confidence to challenge while keeping strong working relationships; a relevant certification (CIPP/E, CIPM, CISM, CISA, or similar) or familiarity with ISO 27001/Cyber Essentials/SOC 2 is a plus
• Imposter syndrome is real — and we don’t expect you to tick every box. If you're excited about our mission and think you could make a difference here, we want to hear from you

What the job involves

• As Birdie's Risk & Compliance Manager, you will be responsible for defining, embedding, and monitoring Birdie’s compliance frameworks across data protection, information security, and health system governance
• You will lead our compliance programs for critical health-sector standards—including the NHS Data Security and Protection Toolkit (DSPT) and Digital Social Care Record (DSCR) compliance—and assure all requirements for core NHS service integrations such as GP Connect and the Patient Demographic Service (PDS)
• You will work closely with our engineering, product, legal, and operational teams, and will be supported by our General Counsel and external Data Protection Officer (DPO)
• Own data protection compliance across product and operations, working with our external DPO on DPIAs, RoPA and information rights processes
• Lead the annual NHS DSPT submission and keep us at "Standards Met" year-round, alongside DSCR and clinical risk alignment (DCB0129/0160) where applicable
• Assure our NHS interoperability connections - GP Connect, PDS, and future health data integrations - meet compliance and data flow standards
• Maintain Birdie's risk register and control frameworks, running third-party risk assessments and internal audit cycles
• Lead incident response for data protection and compliance breaches, from root-cause analysis through remediation
• Build KRIs/KPIs for leadership and the board, and champion a proactive, risk-aware culture across tech, product and go-to-market teams

Benefits

• Most roles are based out of our office in Waterloo, just by the London Eye and Southbank, with a terrace and collaborative space to work from. We work hybrid, with flexibility on when you come in and how you structure your day around your commitments. We bring the team together throughout the year through regular in-person meetups, socials and offsites.
• A yearly personal development budget to put towards books (e.g., free audible subscription), courses, training and conferences; as well as continuous coaching within the team and with external experts. It’s about having a clear understanding of what it takes to grow from A to B, so you can do your best work.
• 33 days base holiday (25 days + 8 bank holidays), birthday off, and company closure between Christmas Eve and New Years.
• Generous parental leave: Once you've spent 12 consecutive months on our payroll, primary caregivers get 16 weeks of leave at full base salary (rising to 20 weeks after 3 years with us), and secondary caregivers get 4 weeks (rising to 8 weeks after 3 years with us).
• The choice between private health insurance with Axa, or a £180 quarterly wellbeing budget - whichever suits you best. Either way, you'll also get perks through Happl (gym discounts, mental health support and more).
• Cycle to work scheme
• 4% employer pension contribution when you contribute 5%.
• 2 paid volunteering days each year to support causes that matter to you.
• 5 paid days for fertility treatment, for anyone who needs it.