GRC Security Lead — SOC 2 & ISO 27001 Expert

Maisa; Asturias; Hybrid; EUR 65,000 - 90,000; Full time

Benefits offered by this job

Remote-friendly

Hybrid hubs

Weekly team lunches

Valencia transport

Job summary

Maisa builds AI for the enterprise, with a focus on regulated industries. The Information Security Manager will own and continuously improve Maisa’s security compliance program, leading SOC 2 Type II and ISO/IEC 27001:2022 through audits and certification, then maintaining them.

The role covers policy, governance, risk, third‑party risk, and client security reviews across AWS, Kubernetes, and CI/CD. This is a hands-on role, with audits, evidence, and a focus on scalable controls.

Qualifications

• 5+ years in information or cyber security, governance, risk and compliance.
• Hands-on SOC 2 or ISO 27001 audits, certification cycles.
• Strong knowledge of ISO 27001:2022 and SOC 2 criteria.
• Experience designing and documenting controls.
• Hands-on third‑party risk management.
• Security questionnaires and client audits experience.
• IAM, secure software development, vulnerability management.
• Incident response, logging and monitoring.
• Business continuity and disaster recovery.
• Excellent written communication for policies and reports.

Responsibilities

• Lead SOC 2 Type II and ISO 27001 programs from readiness to certification.
• Shape certification roadmap as client demands grow.
• Run ISMS day to day: policies, controls, audits, and management review.
• Coordinate control implementation across multiple functions.
• Own company-wide information security and AI risk management.
• Lead third-party risk management and vendor due diligence.
• Handle customer security assessments and audits.
• Keep processes running and produce audit evidence.

Skills

Governance

Risk management

Compliance program

SOC 2

ISO 27001

ISMS

Audits

Third‑party risk

Security awareness

Identity management

Access management

Vulnerability management

Incident response

Logging & monitoring

BCDR

Project management

Executive reporting

Tools

Vanta

Drata

Secureframe

AWS

Kubernetes

Job description

Maisa builds AI for the enterprise, with a focus on regulated industries. The Information Security Manager will own and continuously improve Maisa’s security compliance program, leading SOC 2 Type II and ISO/IEC 27001:2022 through audits and certification, then maintaining them.

The role covers policy, governance, risk, third‑party risk, and client security reviews across AWS, Kubernetes, and CI/CD. This is a hands-on role, with audits, evidence, and a focus on scalable controls.