Senior Data Protection & Privacy Manager in Surrey

When you join Cubic, you become part of a company that creates and delivers technology solutions in transportation to make people’s lives easier by simplifying their daily journeys, and defense capabilities to help promote mission success and safety for those who serve their nation. Led by our talented teams around the world, Cubic is committed to solving global issues through innovation and service to our customers and partners.

Reporting to the VP & General Counsel, EMEA, the Senior Data Protection & Privacy Manager serves as the regional subject matter expert for data protection and privacy matters across EMEA. The role is responsible for leading the development, implementation, and continuous improvement of Cubic's privacy compliance programme, ensuring adherence to applicable data protection laws, regulatory requirements, customer obligations and internal governance standards.

The role provides strategic guidance to business leaders, programme teams, engineering functions, information security teams, bid teams and commercial stakeholders regarding privacy risk management and regulatory compliance. The position leads complex privacy initiatives across multiple business units, supports organisational decision-making on privacy matters, and drives the development of practical and scalable compliance solutions that enable business objectives while appropriately managing legal, regulatory and commercial risk.

The role acts as a trusted advisor to senior management and serves as a recognised authority on privacy and data protection matters within the region. The role also provides specialist leadership on privacy considerations associated with artificial intelligence and emerging technologies, ensuring that AI-enabled systems and business processes incorporate appropriate privacy safeguards and comply with applicable data protection and privacy-related regulatory requirements.

Essential Job Duties and Responsibilities

• Privacy Governance and Strategy
  • Lead the implementation and ongoing development of the EMEA privacy compliance framework.
  • Develop, maintain and enhance privacy policies, standards, guidance and operating procedures.
  • Establish privacy governance mechanisms, controls and performance metrics to ensure continued regulatory compliance.
  • Drive continuous improvement initiatives to strengthen Cubic's privacy maturity and risk management capability.
  • Monitor emerging regulatory developments and assess their impact on Cubic's products, services and business operations.
  • Monitor developments relating to privacy aspects of AI regulation, including the EU AI Act where relevant to data protection obligations, and advise the business on resulting compliance requirements and privacy risk considerations.
  • Ensure that privacy governance frameworks appropriately address the use of AI-enabled technologies, including the management of privacy risks arising from automated processing, machine learning and emerging technology deployments.
• Privacy Risk Management
  • Lead privacy risk assessments across systems, products, programmes and business operations.
  • Direct privacy impact assessments and data protection reviews for new technologies, solutions and operational changes.
  • Direct privacy impact assessment activities relating to AI-enabled systems and high-risk processing activities involving personal data.
  • Identify privacy risks, compliance gaps and control deficiencies, recommending proportionate and commercially practical mitigation strategies.
  • Provide privacy guidance on complex business initiatives, strategic customer engagements and technology deployments.
  • Advise stakeholders on privacy risks associated with automated decision-making, profiling, machine learning technologies and emerging digital products.
  • Support incident management activities involving personal data and advise on regulatory reporting obligations where required.
• Business Support and Advisory
  • Act as the primary privacy advisor to programme teams, engineering organisations, commercial functions and business leadership.
  • Provide expert advice during customer negotiations, bids, requests for proposals and contractual discussions involving privacy and data protection requirements.
  • Partner with Legal, Contracts, Information Security, Product Development and Operational teams to ensure privacy requirements are embedded into business processes and system designs.
  • Ensure privacy considerations are incorporated into AI supplier assessments, procurement activities and contractual arrangements involving AI-enabled solutions.
  • Translate complex legal and regulatory requirements into practical business solutions.
• Programme Leadership
  • Lead cross-functional privacy projects and compliance initiatives involving multiple stakeholders and business functions.
  • Coordinate privacy remediation programmes arising from audits, assessments, customer requests or regulatory change.
  • Establish priorities, define implementation approaches and monitor organisational progress against compliance objectives.
  • Influence decision-making across multiple departments to achieve programme outcomes.
• Audit and Regulatory Engagement
  • Lead privacy compliance reviews and support internal and external audits.
  • Act as a key point of contact for customer privacy assessments and due diligence activities.
  • Support engagement with regulators, external advisors and auditors on privacy matters as required.
  • Oversee the preparation and maintenance of privacy compliance documentation and evidence repositories.
• Knowledge Sharing and Functional Leadership
  • Provide functional leadership and privacy expertise across the organisation.
  • Mentor stakeholders and project teams regarding privacy obligations and best practices.
  • Develop and deliver privacy awareness and training programmes.
  • Develop and deliver awareness and training activities relating to data protection obligations, privacy risks and responsible handling of personal data within AI-enabled environments.
  • Promote a culture of privacy compliance and accountability across the business.

Minimum Job Requirements

• Experience
  • Significant experience in privacy, data protection, information governance, information security, regulatory compliance or related disciplines.
  • Demonstrable experience developing and implementing privacy compliance programmes within a complex commercial organisation.
  • Experience advising senior business stakeholders on regulatory risk, governance and compliance matters.
  • Proven experience managing complex cross-functional projects involving multiple business functions and stakeholders.
  • Experience supporting major customer engagements, audits and regulatory assessments.
  • Experience working within technology, transportation, critical infrastructure, government contracting or similarly regulated environments is desirable.
  • Experience advising on privacy compliance requirements relating to AI-enabled systems, automated decision-making and emerging technologies.
  • Demonstrated understanding of privacy risks associated with artificial intelligence, machine learning and automated decision-making technologies.
• Skills, Knowledge and Expertise
  • Expert knowledge of UK GDPR, EU GDPR and privacy governance principles.
  • Strong understanding of privacy-by-design methodologies and their application within technology and engineering environments.
  • Strong understanding of privacy considerations arising from AI-enabled technologies, including transparency, data minimisation, individual rights safeguards and lawful processing requirements.
  • Strong commercial awareness with the ability to balance legal, operational and customer requirements.
  • Exceptional analytical and problem-solving capability.
  • Ability to assess complex regulatory requirements and develop practical implementation strategies.
  • Ability to assess privacy-related elements of emerging AI regulatory frameworks and translate them into practical data protection compliance requirements.
  • Strong stakeholder management and influencing skills.
  • Excellent written and verbal communication skills, including the ability to communicate with executive audiences.
  • Ability to exercise independent judgement on complex and sensitive matters.
• Education and Qualifications
  • Essential: Degree or equivalent professional experience.
  • Desirable: CIPP/E, CIPM, CIPT or equivalent privacy qualification; CISM, CISSP, CISA, CCSP or equivalent security certification; Prince2, Agile or equivalent project management qualification; TOGAF or related enterprise architecture certification; AI governance or responsible AI certification, such as AIGP or equivalent experience, desirable where focused on privacy and data protection implications of AI.
• Personal Qualities
  • Recognised as a trusted advisor and subject matter expert.
  • Commercially astute and capable of balancing business objectives with regulatory requirements.
  • Able to influence outcomes across diverse stakeholder groups without direct authority.
  • Highly self-motivated and capable of operating with substantial autonomy.
  • Skilled at managing competing priorities in complex organisational environments.
  • Strong strategic thinker with the ability to connect regulatory requirements to broader business objectives.
  • Committed to delivering practical, high-quality and risk-based solutions.

The description provided above is not intended to be an exhaustive list of all job duties, responsibilities and requirements. Duties, responsibilities and requirements may change over time and according to business need.

We are committed to creating an inclusive workplace and welcome applications from people of all backgrounds. We do not discriminate based on any protected characteristic under applicable law.

Location: Salfords, Surrey
Type: Full time