GRC Security Manager: SOC 2 & ISO 27001 Lead (Remote)

Maisa; Asturias; Hybrid; EUR 70,000 - 110,000; Full time

Job summary

Maisa builds AI for the enterprise and seeks an Information Security Manager to own and improve the security compliance program. You will lead SOC 2 Type II and ISO/IEC 27001:2022 through audits, then sustain them, while expanding to new frameworks as client needs grow.

The role covers policy, governance, risk, third‑party risk, and client security reviews, with hands‑on audits and cross‑functional collaboration across Engineering, Legal, and Finance.

Qualifications

• 5+ years in information or cyber security, most of it in governance, risk and compliance.
• Hands‑on SOC 2 or ISO/IEC 27001 program work including at least one audit or certification cycle.
• Strong understanding of ISO 27001:2022, SOC 2 criteria, ISMS operation, risk assessment and control testing.
• Experience designing and documenting controls, not only collecting evidence.
• Hands‑on third‑party risk management and responding to enterprise security questionnaires.
• Familiarity with governance and common security processes (IAM, secure software development, vulnerability management, incident response, logging, disaster recovery).

Responsibilities

• Lead SOC 2 Type II and ISO 27001 programs from readiness to certification and ongoing operations.
• Shape the certification roadmap for client demands and additional frameworks.
• Run the ISMS daily; turn framework requirements into practical controls with owners and evidence.
• Coordinate control implementation across Engineering, Security, Platform, Operations, Legal, Finance.
• Own company‑wide information security and AI risk management processes and risk registers.
• Run third‑party risk management, vendor due diligence, and security reviews with Legal.
• Lead responses to customer security assessments and questionnaires.
• Maintain recurring processes: awareness, access reviews, incident and change management, business continuity.

Skills

Governance & compliance

SOC 2 knowledge

ISO 27001 knowledge

Audit coordination

Risk assessment

Documentation & reporting

Cross-functional coordination

Tools

Vanta

Drata

Secureframe

AWS

Kubernetes

Job description

Maisa builds AI for the enterprise and seeks an Information Security Manager to own and improve the security compliance program. You will lead SOC 2 Type II and ISO/IEC 27001:2022 through audits, then sustain them, while expanding to new frameworks as client needs grow.

The role covers policy, governance, risk, third‑party risk, and client security reviews, with hands‑on audits and cross‑functional collaboration across Engineering, Legal, and Finance.