Information Security Consultant

Role – Information Security Consultant

Opening for – Privacy Consultant.

Location – London & Manchester

Office based Hybrid or Remote – Hybrid (will be required onsite 2-3 Days a week)

Main Responsibilities

Role specific

Client is partway through a significant technology transformation, modernising the systems and processes that support its customers and colleagues. As with any major change programme, embedding privacy and security into the design of new solutions is critical — both to meet regulatory expectations and to maintain the trust of customers.

We are looking for a Senior Privacy Consultant who is motivated by complex, hands-on problem solving. This is not a policy role; it is a delivery-focused consultancy position working directly with project teams, engineers, and product managers. The role spans multiple portfolios, giving you broad exposure to a wide variety of initiatives — from advising on lawful basis for new services, to supporting data sharing agreements, to addressing the risks of using personal data in testing.

Unlike many privacy roles that sit apart from delivery, this position is about helping teams move forward while staying compliant. You will play an important role in shaping how the Bank applies privacy by design and default across its change programme, ensuring critical systems launch securely and on time. The variety of work means you will regularly face new and nuanced challenges — the kind that require both regulatory expertise and the ability to develop pragmatic, workable solutions.

This is a consultancy-style role that relies on influence and collaboration. You’ll partner with embedded security consultants (who support individual projects), providing specialist input when privacy issues become more complex. You’ll also work closely with the Privacy Office and the Data Protection Officer to ensure alignment with regulatory expectations, while keeping delivery teams focused on practical solutions.

If you are looking for a role where you can apply your privacy expertise to real delivery problems, contribute directly to a bank-wide transformation, and build strong relationships across technology and business teams, this role is for you.

Key Responsibilities:

• Act as the privacy SME across technology change initiatives, providing pragmatic advice to embedded security consultants, engineers, and product teams.
• Lead complex privacy risk assessments. supporting teams to identify and mitigate privacy risks, proposing practical solutions that balance compliance and delivery needs
• Advise on lawful basis, special category data, controller/processor arrangements, and data sharing agreements.
• Partner with security consultants to address intersections between privacy and security (e.g. authentication, data in test, third-party risk).
• Build strong relationships with delivery teams, the Privacy Office, and the DPO, acting as a trusted advisor.
• Stay up-to-date with UK/EU data protection requirements and bring forward new approaches to embedding privacy into delivery.
• Take an active role in supporting Embedded Security Consultants to increase their Privacy expertise and knowledge, facilitating training workshops, undertaking quality assurance and, where necessary, follow-up coaching/support.

You could be a good fit for this role if…

• Thrive on autonomy and solving novel privacy problems in complex delivery environments.
• Can translate regulatory requirements into practical advice for non-privacy specialists.
• Enjoy working across multiple teams and portfolios, quickly building trust and influence.
• Have strong knowledge of GDPR, UK DPA, and privacy risk management in technology projects.
• Bring a working knowledge of information security principles and controls.

Professional Qualifications

The successful applicant will have a solid understanding of data privacy best practice and regulatory requirements, and ideally will have good practical experience in information security as well. They will also ideally:

• hold or have the capability to attain appropriate external qualifications, such as Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM) or Certified Information Privacy Technologist (CIPT)

Relevant Experience

Must Haves:

• Proven experience advising delivery teams on privacy requirements in technology change or transformation.
• Strong knowledge of GDPR and UK data protection law, including lawful basis, DPIAs, and controller/processor arrangements.
• Demonstrated ability to deliver pragmatic privacy solutions in complex environments.

Nice to Haves:

• Financial Services - Experience working in FS or other highly regulate industry
• Intra-Group – Experience working in a intra-group outsourcing arrangement
• Technology Transformation - Experience working on large-scale technology transformation programmes