Risk & Compliance Manager in London

At Birdie, we’re reimagining care for older adults. We’re building the technology that powers the future of home healthcare, empowering care teams with tools to deliver better, more dignified care, and enabling older people to thrive in their own homes for longer. Our all-in-one solution powers millions of care visits every month, equipping care providers with the tools they need to deliver exceptional, efficient care.

Your mission as Birdie's Risk & Compliance Manager will be to define, embed, and monitor Birdie’s compliance frameworks across data protection, information security, and health system governance. You will lead our compliance programs for critical health-sector standards—including the NHS Data Security and Protection Toolkit (DSPT) and Digital Social Care Record (DSCR) compliance—and assure all requirements for core NHS service integrations such as GP Connect and the Patient Demographic Service (PDS).

You will work closely with our engineering, product, legal, and operational teams, and will be supported by our General Counsel and external Data Protection Officer (DPO).

How you will contribute:

• Own data protection compliance across product and operations, working with our external DPO on DPIAs, RoPA and information rights processes.
• Lead the annual NHS DSPT submission and keep us at 'Standards Met' year-round, alongside DSCR and clinical risk alignment (DCB0129/0160) where applicable.
• Assure our NHS interoperability connections - GP Connect, PDS, and future health data integrations - meet compliance and data flow standards.
• Maintain Birdie's risk register and control frameworks, running third-party risk assessments and internal audit cycles.
• Lead incident response for data protection and compliance breaches, from root-cause analysis through remediation.
• Build KRIs/KPIs for leadership and the board, and champion a proactive, risk-aware culture across tech, product and go-to-market teams.

You’ll thrive here if:

• You have strong familiarity with NHS DSPT, DSCR, and NHS API assurance frameworks (GP Connect, PDS).
• You know UK GDPR and the Data Protection Act 2018 inside out, and can apply it practically in a fast-moving SaaS environment.
• You’ve led or played a major role in risk assessments, control design, and managing a business risk register - ideally alongside an external DPO or legal counsel.
• You can turn complex legal and health-system regulations into clear, actionable requirements for engineers and product teams.
• You write and speak with clarity, whether it's a policy, an executive report, or team training.
• You have sound judgment and the confidence to challenge while keeping strong working relationships; a relevant certification (CIPP/E, CIPM, CISM, CISA, or similar) or familiarity with ISO 27001/Cyber Essentials/SOC 2 is a plus.

What you’ll get from us:

• Competitive base salary, reviewed against benchmarks annually.
• Generous stock options.
• Annual personal learning budget and access to training, coaching and mentorship.
• Hybrid working - up to 3 days per week in our incredible London HQ.
• 33 days holiday (25 days + public holidays) and extra day off on your birthday.
• Industry leading paid primary and secondary caregiver leave.
• Private health insurance with AXA.
• Cycle to work scheme and 4% employer pension contribution when you contribute 5% (UK).

We’re committed to building a diverse team and inclusive culture. That means creating a hiring process that gives everyone a fair chance regardless of background, identity or lived experience.

Ready to build the future of care? Apply now. Be part of something that matters.