Security GRC Engineer

Kantox; Barcelona; Híbrido; EUR 90 000 - 120 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Free private health insurance

Relocation package if required

Flexible working hours

Hybrid model 4 days in office, 1 day W

31 days annual leave

Gym discounts

Resumo da oferta

Kantox is seeking a Senior Security GRC Engineer to own the control framework operations, ensure ongoing compliance, and drive certifications such as ISO 27001, SOC 2 Type II, and GDPR readiness. You will work closely with the CISO and Risk teams to automate evidence collection and reporting.

The role requires 5+ years in GRC or risk in regulated environments, strong ISO 27001/SOC 2 experience, and proficiency with automation via scripts and APIs.

Qualificações

• 5+ years of professional experience in GRC, security compliance, or risk roles, ideally in regulated environments like financial services, payments, or SaaS.
• Hands-on experience running ISO 27001 and SOC 2 Type II cycles from gap assessment to audit.
• Mastery of risk assessment methodologies such as ISO 27005, with ability to explain risk to non-security colleagues.
• Ability to automate evidence collection and recurring tasks using scripts and APIs.
• Fluent in English; knowledge of GDPR/DORA in EU financial regulation is a plus.

Responsabilidades

• Operate the control calendar and ensure recurring controls, reviews, and audits are evidenced.
• Coordinate with control owners across Tech, Legal, and Risk teams and report overdue items.
• Maintain assets, risks, and audits in the tracking tools; keep SoA up to date.
• Handle non-conformities through to closure and support audits and certifications.
• Automate evidence collection and reporting using Jira, CISO-Assistant, Okta, AWS, and Slack.
• Produce KPIs and reports for the Information Security Committee.

Conhecimentos

GRC

ISO 27001

SOC 2

Risk management

Security controls

English fluency

Formação académica

ISO 27001 Lead Implementer

CISA

CISSP

Ferramentas

CISO-Assistant

Jira

Confluence

Okta

AWS

Descrição da oferta de emprego

Senior Security GRC Engineer | Based in Barcelona

At Kantox, we are looking for a talented Senior Security GRC Engineer to join our Security team. This pivotal role makes sure that our security controls keep operating and keep producing evidence all year round, so that our certifications and regulatory obligations are maintained: ISO 27001, SOC 2, DORA and GDPR, with ISO 42001 possibly to come. As a company that sells a payment solution, we are expected to meet a very high standard of cybersecurity and data protection. You will take ownership of the day to day operation of our control framework, so that the CISO can focus on security strategy and decisions rather than on run tasks, and so that Kantox stays compliant and responsive to its stakeholders whoever is available.

Задачи

• Control Framework Operation Owning the control calendar: making sure every recurring control, review, test and committee (access reviews, annual controls review, internal audit, management review, business continuity and incident response tests, security awareness) happens on schedule and is evidenced
• Following up with control owners across Tech, Infrastructure, Legal and the Risk Team, and reporting overdue items
• Maintaining assets, risks, applied controls and audits in CISO-Assistant, and keeping the Statement of Applicability up to date
• Handling non-conformities through to closure
• Certifications and Audits Maintaining ISO 27001 and driving the SOC 2 Type II readiness: closing open gaps and preparing evidence before auditors start
• Supporting DORA and GDPR obligations including ICT risk framework review, inputs to the Register of Information, and contractual clauses, as well as group or external audits
• Contributing to the preparation of ISO 42001 certification if decided
• Coordinating with auditors and managing findings through to closure
• Risk and Third-Party Assessments Conducting risk assessments following our procedure (ISO 27005, DORA Art. 6) and preparing Risk Decisions for validation by the CISO
• Performing security assessments of new vendors and solutions, including AI tools and MCP servers
• Analysing AI use cases submitted through our AI Champion Programme and proposing classification and treatment options
• Support to Sales and Customers Answering stakeholder and prospect security questionnaires, due diligence requests, and contractual security clauses within a defined service level, including when the CISO is unavailable
• Supporting GDPR managers across the business to ensure their GDPR duties are properly met and evidenced
• Maintaining the trust pack: certificates, SOC 2 report when available, and a reusable answer library
• GRC Engineering and Continuous Improvement Automating evidence collection, review reminders, and control monitoring through integrations with Jira, CISO-Assistant, Okta, AWS, and Slack
• Building and improving agent-assisted workflows with human validation
• Producing KPIs and reports for the Information Security Committee, communicating clearly to non-technical audiences
• The setup You will join a Security team led by the CISO, working closely with the Tech organisation, Legal, the Data Protection Officer, and the Risk Team. You will also build the automation that makes this sustainable: evidence collection, review reminders and reporting, using our existing tools (CISO-Assistant, Jira, Confluence) and AI-assisted workflows with human validation.

Требования

• You have 5 years of professional experience in GRC, security compliance or risk roles, ideally in a regulated environment such as financial services, payments, or SaaS. You have a proven track record of running controls and audits, and you are autonomous and rigorous: you can run a queue of requests, own deadlines, and challenge control owners constructively. Concretely: 5+ years of professional experience in GRC, security compliance, or risk roles, ideally in a regulated environment such as financial services, payments, or SaaS
• Hands-on experience running at least one ISO 27001 cycle and one SOC 2 Type II cycle, from gap assessment to audit
• Mastery of risk assessment methodologies such as ISO 27005 or equivalent, and ability to explain risk clearly to non-security colleagues
• Ability to automate with scripts (Python or similar) and APIs to collect evidence and streamline recurring tasks
• Autonomous, rigorous, and comfortable owning a queue of requests and deadlines
• Fluent in English
• Knowledge of DORA and EU financial regulation GDPR knowledge and experience supporting data protection obligations in a regulated environment
• Experience with ISO 42001, AI governance, or third-party AI risk
• Experience with GRC platforms, ideally open source such as CISO-Assistant
• Working knowledge of cloud security (AWS) and identity management (Okta)
• Experience with agile methodologies and collaboration tools like Jira and Confluence
• Certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISSP

Условия

• Competitive salary
• Sponsored learning and development budget
• Free private health insurance
• Free language lessons (Spanish, English, French and Catalan)
• Relocation package if required
• Flexible working hours and short Fridays
• Hybrid working model (4 days in office, 1 day from home)
• 31 days of annual leave
• Gym discounts and free sports activities
• Restaurant Ticket with monthly credit and regular cross-team lunches
• Fresh fruit and unlimited coffee
• Barcelona office with 360° views of the city
• We are a 200-person fintech and a BNP Paribas company, with offices in London and Barcelona. We have grown consistently since 2011, built on a product that handles real financial complexity for clients who depend on it every day. If you want to own the security compliance function of a regulated fintech and build the automation that makes it scale, this is the role.
• Kantox is an equal opportunity employer. We hire on merit and welcome applicants regardless of background, nationality, gender, age, sexual orientation, or disability status.