InfoSec Risk Manager – 2LoD, ISO27001 & PCI DSS

MultiSafepay; Málaga; Presencial; EUR 70.000 - 100.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Free Spanish classes

Afterwork sports activities

Professional growth opportunities

International team

Descripción de la vacante

MultiSafepay, a leading FinTech in Europe, seeks an Information Security Risk Manager to own the ICT risk framework and the Eramba GRC suite in the second line of defence. You will oversee risk registers, ISMS policy alignment, and 2LoD PCI DSS and DORA governance, reporting to senior risk leadership.

The role requires 5–8 years in ICT risk management, strong knowledge of DORA and ISO 27001, and experience translating complex tech risks to executives.

Formación

• Candidates must have experience in ICT risk management within regulated financial environments.
• Strong knowledge of DORA, ISO/IEC 27001 and PCI DSS v4.0 is required.
• Experience with GRC platforms such as Eramba and RCSA execution is essential.

Responsabilidades

• Maintain and develop the ICT risk register and monitor ICT controls via KRI dashboards.
• Own the ISMS policy suite aligned with ISO 27001 and DORA; coordinate 2LoD oversight.
• Support DORA obligations including ICT incident classification and major incident reporting.
• Lead PCI DSS 2LoD governance and coordinate PCI-3DS as a project stream.
• Manage Eramba GRC platform data structures, user access, and rollout to new modules.
• Provide second line of defence oversight of ICT third-party risk and support EY IT audit.

Conocimientos

ICT risk management

ISO 27001

PCI DSS

GRC platform (Eramba)

RCSA

KRI reporting

2LoD governance

stakeholder communication

DORA

Educación

Bachelor's or Master's in Information Security / CS / Risk Management

Herramientas

Eramba GRC

Descripción del empleo

MultiSafepay, a leading FinTech in Europe, seeks an Information Security Risk Manager to own the ICT risk framework and the Eramba GRC suite in the second line of defence. You will oversee risk registers, ISMS policy alignment, and 2LoD PCI DSS and DORA governance, reporting to senior risk leadership.

The role requires 5–8 years in ICT risk management, strong knowledge of DORA and ISO 27001, and experience translating complex tech risks to executives.