Security Governance Architect: Policy & Compliance

ALS; Madrid; On-site; EUR 65,000 - 95,000; Full time

Job summary

ALS is seeking an Information Security Governance Specialist to own the governance backbone of the security programme, translating strategy into auditable policies, control frameworks and audit programmes across the business.

You will develop, review, and map controls to ISO 27001, NIST CSF, GDPR, and other standards; manage the exception/waiver process; coordinate audits; and produce executive dashboards for boards and senior management.

Responsibilities

• Develop, maintain, and periodically review information security policies, standards, and procedures aligned to ISO 27001 and other recognised cybersecurity frameworks.
• Maintain the security governance calendar (policy reviews, management reviews).
• Support design and evolution of the organisation's security strategy and multi-year security programme roadmap.
• Administer the security exception/waiver process end-to-end: intake, documentation, approval routing, and tracking of time-bound remediation commitments through to closure.
• Maintain the control framework catalogue, mapping controls to ISO 27001 Annex A, NIST CSF, and CIS Controls, and flag control gaps for risk assessment by the Information Security Risk Specialist.
• Partner with the Information Security Risk Specialist to ensure exceptions and control gaps are risk-assessed and formally risk-accepted by the appropriate owner before a waiver is granted.
• Coordinate internal and external audits and certification cycles (e.g. ISO 27001), including evidence collection and remediation tracking.
• Map controls to regulatory and contractual obligations (GDPR, PCI-DSS, HIPAA, sector-specific requirements as applicable).
• Maintain a defensible audit trail for control operation and governance decisions.
• Produce executive-ready reporting: governance and compliance dashboards, programme status updates, board and committee papers.
• Act as a trusted point of contact for business units seeking governance guidance on new initiatives.
• Contribute governance input to post-incident reviews and remediation programmes, ensuring lessons learned convert into control or policy change.
• Support the broader team on cross-functional initiatives (e.g. data protection projects, security awareness) as priorities require.

Job description

ALS is seeking an Information Security Governance Specialist to own the governance backbone of the security programme, translating strategy into auditable policies, control frameworks and audit programmes across the business.

You will develop, review, and map controls to ISO 27001, NIST CSF, GDPR, and other standards; manage the exception/waiver process; coordinate audits; and produce executive dashboards for boards and senior management.