Risk Technology & Cybersecurity Specialist III

About the role

We are looking for a senior analyst to lead second‑line cyber risk reviews for Santander Corporate & Investment Banking in Boadilla del Monte, Madrid. The role combines deep technical knowledge with the ability to translate risk findings into clear recommendations for senior stakeholders.

Key responsibilities

• Lead 2LoD review and challenge of cybersecurity risk assessments, control evaluations, risk metrics, mitigation plans and risk acceptances, delivering concise risk opinions.
• Conduct targeted risk reviews of priority domains such as IAM, network/firewall, vulnerability & patch management, cloud security, application/container security, encryption, tokenization, DLP, logging/monitoring, and incident response/SOC, and track remediation to closure.
• Provide independent oversight of digital transformation and business change initiatives, assessing cyber risk impacts from design through go‑live.
• Strengthen third‑party and critical services risk management by certifying vendors, challenging risk scores, assigning residual risk ratings and monitoring remediation.
• Analyze cyber risk data—including incidents, KRIs, control gaps and risk registers—to identify patterns, concentrations and emerging hotspots.
• Develop and adapt policies and frameworks to support safe technology adoption and align with industry standards.
• Prepare decision‑ready governance reports for committees and working groups, escalating issues with evidence and urgency.

Required profile

• Proven experience as a senior cyber risk analyst or equivalent, preferably within a financial services environment.
• Strong analytical mindset with the ability to synthesize complex data into actionable insights.
• Excellent communication skills to influence senior stakeholders and present risk opinions clearly.
• Track record of overseeing digital transformation projects and third‑party risk programs.

Required skills

• Identity and Access Management (IAM)
• Network and firewall security
• Vulnerability and patch management
• Cloud security
• Application and container security
• Encryption and tokenization
• Data Loss Prevention (DLP)
• Logging and monitoring
• Incident response and Security Operations Center (SOC)
• Cyber risk assessment and metrics
• Risk register analysis and KRIs
• Third‑party risk management