GRC Lead

Salmon Group Ltd; España; Remote; EUR 70,000 - 95,000; Full time

Benefits offered by this job

Medical insurance

Mental health support

Vacation days

Team trips to Manila

Company-provided tools

Fully remote work

Job summary

Salmon Group Ltd is seeking an experienced information security professional to own risk management, control assurance, and ISO 27001 ISMS governance across our regulated group spanning banking, consumer finance, and technology.

You will assess controls across IAM, cloud, endpoints, monitoring, vulnerability management, and data protection, turning data into clear risk reporting for governance forums and ongoing risk treatment.

Qualifications

• Strong practical experience in information security risk management and control assurance.
• Ability to turn risk information into concise governance reporting.
• Familiarity with ISO 27001 ISMS and risk registers.

Responsibilities

• Own the security risk process end to end, including assessment, treatment, and reporting.
• Assess control design and operating effectiveness across IAM, cloud, endpoints, monitoring, and data protection.
• Produce clear, decision-ready reporting for governance forums.

Skills

Information security

Risk management

GRC platforms

ISO 27001 knowledge

Tools

IAM

Cloud security

Endpoint security

Monitoring tools

Vulnerability management

Job description

Remote

Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines.

We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region.

7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors.

Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries.

If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us.

Southeast Asia's fintech moment starts here.

About The Role

You’ll own information security risk management, control assurance, and ISO 27001 ISMS governance across a regulated group spanning banking, consumer finance, and technology.

What You'll Do

• Form an independent view of security risk and challenge whether proposed controls actually address it, working directly with the Group CISO
• Assess control design and operating effectiveness across areas such as IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development
• Turn risk and control data into clear, decision-ready reporting for governance forums

What You'll Own

• Own the security risk process end to end: assessment, treatment, acceptance, monitoring, and reporting
• Maintain the risk register and challenge risk assessments and treatment plans so residual risk, ownership, and remediation status stay current
• Maintain the security control framework, test controls using evidence, data, sampling, or technical validation, and drive remediation with control owners
• Maintain the ISO 27001 ISMS: policies and standards, Statement of Applicability, risk records, control evidence, exceptions, and key security registers
• Track control deficiencies, findings, exceptions, and remediation actions
• Define KRIs and control metrics, and flag where management decisions or escalation are needed

What Makes You a Strong Fit

• Strong practical experience in information security risk management: inherent and residual risk, treatment, acceptance, control effectiveness, risk appetite
• Enough technical depth to critically assess controls across IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development
• Hands-on experience reviewing or testing controls, with the ability to distinguish a documented control from an effective one
• Working knowledge of ISO 27001, with the ability to turn complex risk and control information into concise management reporting
• Comfortable working with GRC platforms, structured risk and control registers, and evidence management

What We Offer

Ownership and flexibility

• Fully remote work with core collaboration hours from 12:00 to 6:00 PM Manila time (UTC+8)
• Company-provided tools and equipment

Health and time off

• Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits
• Access to an internal mental health support specialist
• 22 vacation days, Philippine public holidays, and 15 sick days

Growth and team experience

• Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications
• Company-sponsored trips to Manila to meet and work with your team in person
• High-performing teams can earn a dedicated beach house week in Southeast Asia

We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.