Information Security Manager - GRC

Maisa; Cantabria; Hybrid; EUR 65,000 - 90,000; Full time

Job summary

Maisa is hiring an Information Security Manager to own and improve the company’s security program. You will lead SOC 2 Type II and ISO/IEC 27001:2022 efforts, build a scalable ISMS, and drive governance, risk and compliance across multiple functions.

You will collaborate with Engineering, Legal, and Finance to implement controls, manage third-party risks, and respond to customer security assessments. This role is remote-friendly with hybrid collaboration in a fast-growing R&D environment.

Qualifications

• 5+ years in information or cyber security, with governance, risk and compliance focus.
• Hands-on experience implementing or operating SOC 2 or ISO/IEC 27001 programs, including audits.
• Strong knowledge of ISO 27001:2022, ISO 27002 controls, SOC 2 criteria, ISMS operation, risk assessment and testing.
• Experience designing and documenting controls, not only collecting evidence.
• Hands-on third-party risk management and experience answering enterprise security questionnaires and client audits.

Responsibilities

• Lead SOC 2 Type II and ISO 27001 programs from readiness to certification, and keep them running.
• Shape the certification roadmap as client demand grows and plan audits, budgets, and tooling.
• Run the ISMS day to day: policies, control ownership, internal audits, and management reviews.
• Coordinate control implementation across Engineering, Security, Platform, Operations, People, Legal, Finance and other teams; drive findings to closure.
• Own the company-wide information security and AI risk management process, including risk registers and remediation plans.
• Run third-party risk management, including vendor due diligence and security reviews with Legal.
• Lead responses to enterprise security assessments, due-diligence questionnaires, and client audits.
• Maintain recurring processes and evidence: awareness, access reviews, incident/change management, BC/DR, and secure development across AWS, Kubernetes, identity systems.

Skills

SOC 2 Type II

ISO 27001

Audit coordination

Risk management

Policy development

ISMS operations

Job description

The Best of Both Worlds

About The Company

The Best of Both Worlds

At Maisa, we believe great work happens when people have the freedom to choose the setup that works best for them.

Prefer the flexibility of remote work?

You’re welcome to work remotely. Most of our roles are currently focused on Spain, although depending on the position and profile, we may be open to hiring from other locations.

Looking for some social energy?

Our hybrid setup gives you the option to connect and work alongside teammates at our hubs in Valencia, Barcelona, Madrid and Murcia. And as we grow, our spaces will grow with us: when we build a team of more than 10 people in a location, our ambition is to create a hub there too.

We also want the time we spend together in person to be worth it. Today, that includes weekly transportation from the city center to our Valencia headquarters and weekly team lunches in Valencia and Barcelona, with more experiences to come as our teams and hubs evolve.

The Culture is OURS to Create

We’re still shaping how we work together—and that’s part of what makes joining Maisa now specifically exciting.

Everyone who joins has the opportunity to influence how we collaborate, connect, and build our culture. Rather than inheriting a finished playbook, you’ll have a voice in creating it.

Remote when you want flexibility. Together when you want connection. And a culture you can help shape from day one.

About The Role

Maisa builds AI for the enterprise, with a focus on regulated industries such as banking. Our clients expect proof that we protect their data and processes, and this role provides it.

We are looking for an Information Security Manager in our Governance, Risk and Compliance function to own and continuously improve Maisa’s security compliance program. Your first priority is leading SOC 2 Type II and ISO/IEC 27001:2022 through audit and certification, then keeping both running. Further frameworks will follow as client demand grows. Beyond certification, the role covers the wider GRC remit: policy and governance, security risk, third‑party risk, and client security reviews.

This is a hands‑on role for someone who carries audits themselves and sees problems through to closure. The objective is not simply to pass audits, but to run a sustainable compliance program that reflects how the company actually operates and can scale with the business.

What you will do

• Lead our SOC 2 Type II and ISO 27001 programs from readiness to certification, then keep them running. Own each audit: scope, evidence, auditors, the certification body, surveillance and renewal.
• Shape the certification roadmap as client demand grows, for example ISO/IEC 42001 for AI governance, or other requirements from regulated clients. Plan the audits, budget and tooling for each addition.
• Run the Information Security Management System (ISMS) day to day: policies, control ownership, the internal audit program and management review. Turn requirements from every framework into one set of practical controls with clear owners, tests and evidence, automated in our compliance management system wherever possible.
• Coordinate control implementation and continuous assessment across Engineering, Security, Platform, Operations, People, Legal, Finance and other business functions. Track progress against milestones and drive findings, exceptions and remediation through to closure.
• Own the company‑wide information security and AI risk management process, including the risk register, treatment plans, risk owner sign‑off and periodic reviews.
• Run third‑party risk management (TPRM): vendor due diligence and assessments at onboarding, contract security review with Legal, and periodic reassessment.
• Lead the response to enterprise customer security assessments, due‑diligence questionnaires, client audits and requests for compliance documentation.
• Keep recurring processes running and producing evidence: security awareness, employee compliance, access reviews, incident and change management, business continuity and secure development. Work with technical teams to verify that controls are effective across AWS, Kubernetes, identity systems, endpoints and CI/CD.

What we are looking for

• 5+ years in information or cyber security, most of it in governance, risk and compliance.
• Strong practical experience implementing or operating SOC 2 or ISO/IEC 27001 programs, including hands‑on work on at least one audit or certification cycle and direct contact with auditors.
• Good understanding of ISO 27001:2022, ISO 27002 controls, SOC 2 Trust Services Criteria, ISMS operation, risk assessment, and control testing.
• Experience designing and documenting controls, rather than only collecting evidence for controls designed by someone else.
• Hands‑on third‑party risk management, plus experience answering enterprise security questionnaires and client audits.
• Strong understanding of information security governance and common security processes such as:
• identity and access management;
• secure software development;
• vulnerability management;
• incident response;
• logging and monitoring;
• business continuity and disaster recovery;
• employee lifecycle and security awareness.
• Ability to work directly with technical teams and understand enough of their systems to determine whether a control is actually effective.
• Strong project‑management and organizational skills, with the ability to coordinate control owners across multiple teams.
• Excellent written communication skills and the ability to produce clear policies, procedures, risk assessments, audit responses, and executive‑level reporting.
• A pragmatic mindset: able to distinguish genuine security and compliance requirements from unnecessary bureaucracy.
• Comfortable operating autonomously in a rapidly changing environment and taking ownership of problems through completion.

Nice to have

• Experience leading a SOC 2 audit or ISO 27001 certification cycle end to end.
• Experience with compliance automation platforms such as Vanta, Drata, Secureframe, or similar.
• Experience working in a B2B SaaS or enterprise software company, preferably serving regulated clients such as banks.
• Experience with cloud‑native environments, particularly AWS and Kubernetes.
• Familiarity with GDPR and European information security and privacy requirements, plus frameworks such as ISO/IEC 42001, ISO/IEC 27701 or the EU AI Act.
• Certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CISM, CRISC, CISSP, or equivalent.
• Experience building or maturing a compliance or ISMS program from an early stage.

What success looks like

Within your first months, you will have a clear view of Maisa’s existing controls, gaps, risks, evidence, and audit readiness, with accountable owners and remediation plans for outstanding work. Maisa then receives its SOC 2 Type II report and ISO 27001 certificate on the planned timeline.

Over time, you will establish a compliance operating model in which:

• Certifications run continuously as the company, product and infrastructure evolve, and new frameworks build on existing controls rather than starting over.
• Risks, exceptions, findings, and corrective actions are actively managed.
• Audit preparation becomes predictable rather than disruptive.
• Control owners understand what is expected from them and why.
• Critical suppliers are assessed before onboarding and reviewed on schedule.
• Security and compliance evidence can be efficiently reused for customer assurance.

How we work

This role sits at the intersection of security, engineering, and business operations. You will be expected to challenge weak controls when necessary, but also to understand the operational cost of compliance requirements and work with teams to find proportionate solutions.

We value compliance that is evidence‑based, automated where possible, integrated into engineering and business workflows, and focused on reducing actual risk.

The right person for this role will combine the rigor required to satisfy auditors with the pragmatism required to operate effectively in a fast‑growing technology company.