Information Security Manager

Ebury; Madrid; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Annual discretionary bonus

Mentorship

Central Madrid office with great comms

Job summary

Ebury Madrid Office is seeking an experienced InfoSec & Compliance Specialist to join our global Information Security function. This hybrid role focuses on keeping ISMS robust and acting as the security face to the business, supporting sales, customers and new initiatives.

You will lead governance, audits, and third-party risk, respond to customer due diligence, and advise on international expansions and product launches, making security a business enabler for growth.

Qualifications

• 5+ years of experience in information security, GRC, or risk management roles, ideally in fintech, financial services, or another regulated environment.
• Proven experience responding to customer security questionnaires, DDQs, and RFPs, and supporting sales or pre-sales teams with security assurance.
• Strong knowledge of information security standards and regulations (ISO 27001, SOC 2, PCI DSS, GDPR, FCA/DORA, NIST, etc.).
• Experience running or supporting internal and external audits, including regulatory audits and working with financial regulators.
• Analytical skills: assess security exceptions as quantified risk; implement risk management processes and security metrics.
• Familiarity with GRC or risk platforms (OneTrust, Vanta, Drata); excellent communication and stakeholder management.
• A commercial mindset: balance risk, deal timelines, and customer expectations.
• Spanish and/or other European languages, in addition to fluent English.

Responsibilities

• InfoSec SME for new business: act as security contact for Sales, Account Management, and Product.
• DDQs and RFPs: own end-to-end responses and assurance requests from customers.
• Customer assurance library: build a central library of approved responses and evidence.
• Customer-facing support: join calls and explain controls to technical and non-technical audiences.
• Expansion and launches: advise on security/regulatory implications for international growth and new products.
• Advisory: respond to internal security queries and anticipate regulatory changes.

Skills

InfoSec SME

GRC

Risk management

Audits

Customer due diligence

Regulatory compliance

Communication

Stakeholder management

Tools

OneTrust

Vanta

Drata

Job description

Ebury helps ambitious businesses unlock global growth, and we take the same approach with our people. We encourage innovation and movement, collaboration and problem-solving, and foster an environment where everyone can feel they belong, are valued, supported and empowered to succeed.

If you’re a collaborator who wants to help transform how businesses operate globally, get in touch - we’d love to discuss how Ebury can accelerate your career so you can shape the future.

Security

Ebury Madrid Office - Hybrid: 4 days in the office, 1 day working from home per week

Ebury is looking for an experienced, hands-on InfoSec & Compliance Specialist to join our global Information Security function, reporting directly to the CISO. This role has two sides: keeping our ISMS and compliance obligations robust and auditready, and acting as the face of Information Security to the business, supporting sales, customers, and new business initiatives.

You will maintain our security frameworks and own day-to-day governance, audits, and third-party risk. You will also act as the InfoSec subject-matter expert for commercial teams, responding to customer due diligence questionnaires and RFPs, supporting security conversations with prospects and clients, and advising on international expansions and new product launches. Your goal is to make security a business enabler: helping Ebury win and retain customers, enter new markets, and launch products with confidence.

What you’ll do

Business Enablement & Customer Assurance:

• InfoSec SME for new business: Act as the security point of contact for Sales, Account Management, and Product, supporting prospects and customers through security reviews, calls, and onboarding.
• DDQs and RFPs: Own the end-to-end response to security due diligence questionnaires, RFP/RFI security sections, and assurance requests from both existing and new customers, ensuring accurate, consistent, and timely answers.
• Customer assurance library: Build and maintain a central library of approved responses, certifications, and evidence (e.g., ISO 27001 certificate, SOC reports, PCI DSS attestation, pen test summaries), and automate response workflows where possible.
• Customer-facing support: Join customer and prospect calls as the security expert, explaining Ebury's controls and posture clearly to technical and nontechnical audiences, and escalating contractual or risk concerns to the CISO.
• Expansion and launches: Advise on the security and regulatory implications of international expansion, new products, and strategic partnerships, providing early guidance so security supports rather than slows delivery.
• Commercial insight: Track recurring customer questions and requirements, and feed trends back to the CISO and product teams to inform the security

Governance & Compliance (BAU):

ISMS and policy management: Lead the annual review and update of security policies, standards, and controls, ensuring alignment with ISO 27001, PCI DSS, SOC 2, NIST, GDPR, DORA, and local regulations.

Internal audits

Plan and run the internal audit programme for the ISMS and key controls, report findings, and track remediation to closure.

External audits and certifications

Act as the point of contact for external auditors and assessors; coordinate evidence gathering, manage audit logistics, and track remediation of findings.

Regulator engagement

Support responses to regulatory enquiries and assessments in fintech and financial services.

Third-party risk management (TPRM)

Evaluate vendor risk through due diligence questionnaires and security reviews for new and existing suppliers.

Security exceptions

Manage the exception lifecycle: review requests, assess and quantify risk and impact, ensure formal sign-off, and drive periodic re-evaluation.

Advisory

Address internal security queries on compliance standards and best practices, and stay ahead of evolving regulation to proactively adapt Ebury's frameworks.

Strategic Project Support:

• Regulatory mapping: Map internal controls against new or upcoming regulations (e.g., EU AI Act, NIS2, DORA, or new regional cybersecurity laws) and identify gaps.
• Process maturation: Move manual BAU tasks (DDQ and RFP tracking, evidence collection, policy distribution) into automated GRC platforms (e.g., OneTrust, Vanta, or Drata).
• Risk and metrics: Help embed risk management processes, control frameworks, and security metrics that give leadership a clear view of posture.
• Security culture: Design and drive awareness programmes that generate genuine behavioural change.

What you’ll need

5+ years of experience in information security, GRC, or risk management roles, ideally in fintech, financial services, or another regulated environment.

Proven experience responding to customer security questionnaires, DDQs, and RFPs, and supporting sales or pre-sales teams with security assurance.

Strong knowledge of information security standards and regulations (ISO 27001, SOC 2, PCI DSS, GDPR, FCA/DORA, NIST, etc.).

Experience running or supporting internal and external audits, including regulatory audits and working with financial regulators.

Analytical skills: the ability to assess a security exception not just as a "no", but as a risk to be quantified. Hands-on experience implementing risk management processes, control frameworks, and security metrics.

Familiarity with GRC or risk platforms (e.g., OneTrust, Vanta, Drata). Excellent communication and stakeholder management skills, with confidence presenting to customers, executives, and technical teams alike.

A commercial mindset: comfortable balancing risk, deal timelines, and customer expectations.

Preferred Qualifications

• Industry certifications such as CISSP, CRISC, CISA, or ISO 27001 Lead Implementer/Auditor.
• Experience in a customer-facing or trust and assurance function.
• Experience with trust centre or questionnaire automation tools.
• Experience supporting multi-jurisdiction expansion and regional regulatory requirements.
• Spanish and/or other European languages, in addition to fluent English.

Why Ebury?

• Competitive Starting Salary with an annual discretionary bonus that truly rewards your performance from day one.
• Dedicated Mentorship: Learn directly from experienced managers who are invested in your success.
• Cutting-Edge Technology: Leverage state-of-the-art tailor made tools and systems that enable you to perform at your best.
• Clear, Accelerated Career Progression: Defined pathways to leadership and specialist roles within Ebury.
• Dynamic & Supportive Culture: Work in a collaborative environment where teamwork and personal growth are prioritized.
• Generous Benefits Package: Access competitive benefits tailored to your location, which typically include health care and social benefits.
• Central Office: A fantastic location with excellent transport links.

About us

Ebury delivers sophisticated, integrated solutions — business accounts, hedging, and financing — on a single platform with a seamless workflow. Our success is built on a simple premise and singular purpose: To help businesses operate and scale globally.

Since its founding in 2009, Ebury has always been a fast-growing leader in fintech. Today, we bring together 2000+ Eburians across nearly 70 cities and we’re always looking to add to our team.

At the heart of our offering is a proprietary platform, purpose-built to help businesses seamlessly streamline and manage global cash flow. We focus on continuous product evolution and innovation to build the infrastructure for borderless growth and help our clients scale at every stage.

The opportunities at Ebury are as diverse as our people, ranging from business development to engineering roles across our tech pillars.

We believe in inclusion. We stand against discrimination in all forms and are against the intolerance of differences that makes us a modern and successful organisation. At Ebury, you can be whoever you want to be and still feel a sense of belonging no matter your story.