IT Security & Compliance Manager

Sinclair; Madrid; Vor Ort; EUR 55.000 - 85.000; Vollzeit

Zusammenfassung

Sinclair in Madrid is seeking an IT Security & Compliance Manager to lead audit readiness and internal controls across IT systems. You will act as the primary liaison for external audits, maintain evidence, and drive remediation with clear ownership.

The role requires 5+ years in IT audit/compliance, SAP/ERP control design, and strong English. You will work in a multinational context with UK/EU data protection exposure and independent work capability.

Qualifikationen

• Five or more years in IT audit, IT compliance or IT risk.
• Led company-side IT audit including scope, evidence, management response and closure.
• Built and operated IT general controls from audit findings across ERP.
• Owned user access reviews and SoD across ERP systems.
• Proficient English, able to work in Spain or Netherlands.
• Capable of working independently; drives own priorities and materials.

Aufgaben

• Act as single point of contact for external audit and internal group audits.
• Maintain a register of IT-related findings with owner and date.
• Report remediation status monthly to Global IT Director and Finance/Legal & Compliance.
• Assemble evidence base: inventory, owner matrix, access/change/backup records.
• Turn findings into documented, repeatable controls with owner and frequency.
• Review software before commitment: data location, terms, security, CSV, exit terms.
• Support UK/EU data protection for systems with hosting locations and transfers.
• Represent controls in SAP/workflow programs: authorization model and audit logging.
• Re-test remediated findings and close with evidence over assertions.

Kenntnisse

IT audit

IT compliance

IT risk

Segregation of duties (SoD)

ERP controls

English proficiency

Ausbildung

CISA/CRISC/ISO 27001 Lead Auditor certification

Tools

SAP

Jobbeschreibung

Join Our Team as a IT Security & Compliance Manager

We are currently recruiting for IT Security & Compliance Manager at our Madrid office.

The ideal candidate will have experience in:

• ITGC
• SoD
• ERP Controls

What You'll Be Doing:

Audit response and readiness — primary

• Act as the single point of contact for external audit, group internal audit and finance control reviews: scope agreement, evidence, walkthroughs, management responses.
• Maintain one register of IT-related findings from every source, each with a named owner and a date.
• Report remediation status monthly to the Global IT Director, and at each audit cycle to Finance and to Legal & Compliance.
• Assemble the evidence base before it is asked for: application inventory, system owner matrix, access records, change records, backup and restore records.

Internal controls, built from audit requirements

• Turn each agreed finding into a documented, repeatable control: control objective, control owner, frequency, evidence retained.
• Start with what is already known to be required, periodic user access review; segregation of duties in ERP and procure-to-pay; a named System Owner for every application.
• Design controls that can be operated at current headcount. Where one cannot be, record the compensating control and the accepted risk rather than writing a control that will fail its next test.
• Re-test what has been remediated, and close findings on evidence rather than assertion.
• Keep the IT policy set current, access, information security and acceptable use, continuity and aligned to what is actually done.
• Review new and renewed software and services before any commitment is made: data location, processing terms, security, GxP impact, exit terms. Conclusion within five working days.
• Support Legal & Compliance on UK and EU data protection where systems are involved: hosting location, transfers, processing agreements, retention.
• Represent controls in the SAP and workflow programmes, authorisation model, segregation-of-duties rules, approval matrix, audit logging — and sign off before configuration freeze.

Your skills and experience

• Five or more years in IT audit, IT compliance or IT risk, within or facing a multi-entity international group.
• Has personally run the company side of an IT audit, scope, evidence, management response, remediation through to closure.
• Has built and operated IT general controls off the back of findings, not only tested them.
• Has owned a user access review and segregation-of-duties cycle across an ERP.
• English to full professional standard, written and spoken; right to work in the Netherlands or Spain.
• Able to work as the only person in the discipline: sets own priorities and writes own material.
• CISA, CRISC, or ISO/IEC 27001 Lead Auditor.
• Pharmaceutical, medical device or medical aesthetics experience, including GxP and CSV /computerized system validation.
• SAP authorisation concept and segregation-of-duties design.
• UK and EU data protection as it applies to systems and vendors.