Information Security Risk Manager — 2LoD & ISO27001 Lead

MultiSafepay; Málaga; On-site; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Salary & benefits package

Free Spanish classes

Professional growth

International team

Job summary

MultiSafepay is seeking an Information Security Risk Manager to own the ICT risk management framework within the second line of defence. You will be responsible for day-to-day execution, monitoring, and reporting of ICT risk and information security activities in line with DORA, ISO 27001, and PCI DSS requirements.

You will own the Eramba GRC platform, ISMS policy suite, and the ICT risk register, providing technical ICT risk input to leadership.

Qualifications

• 5-8 years of experience in ICT risk management or information security in regulated financial institutions.
• Experience with DORA ICT risk management chapter, ISO/IEC 27001, and PCI DSS v4.0.
• Hands-on experience with a GRC platform such as Eramba, including RCSA execution and KRI reporting.
• Strong ability to translate technical risks into clear stakeholder reporting.

Responsibilities

• Maintain and develop the ICT risk register and monitor ICT controls (KRI dashboards).
• Own the ISMS policy suite in line with ISO 27001 and DORA; coordinate 2LoD security monitoring.
• Support DORA Chapter II obligations including incident classification and reporting.
• Lead PCI DSS 2LoD governance and coordinate PCI-3DS as a project stream.
• Own the Eramba GRC platform and rollout to new modules and processes.
• Advise on ICT third-party risk and support EY IT audits and risk reporting.

Skills

DORA ICT risk management

ISO/IEC 27001

PCI DSS v4.0

GRC platforms (Eramba)

Reporting to stakeholders

English communication

Education

Bachelor's or Master's degree in Information Security / Computer Science / Risk Management

Tools

Eramba GRC

Job description

MultiSafepay is seeking an Information Security Risk Manager to own the ICT risk management framework within the second line of defence. You will be responsible for day-to-day execution, monitoring, and reporting of ICT risk and information security activities in line with DORA, ISO 27001, and PCI DSS requirements.

You will own the Eramba GRC platform, ISMS policy suite, and the ICT risk register, providing technical ICT risk input to leadership.