Security GRC Engineer

Glovo Group; Vilanova y Geltrú; On-site; EUR 60,000 - 90,000; Full time

Job summary

Glovo is seeking a proactive Security GRC Engineer to strengthen our global security posture in a rapidly evolving regulatory environment. You will drive risk assessment and remediation, develop security policies, and support audits and certifications across frameworks such as PCI DSS, ISO 27001, NIS2, GDPR, and EU AI Act.

You will bridge technical, legal, and business stakeholders, translating complex regulatory demands into actionable security controls and driving a security-first culture

Qualifications

• Experience with cybersecurity risk management and regulatory frameworks.
• Ability to translate regulatory demands into actionable security controls.
• Familiarity with audits, risk assessments, and remediation tracking.

Responsibilities

• Develop, implement, and maintain security policies aligned with ISO 27001, NIST, PCI DSS, GDPR, NIS2, and EU AI Act.
• Design and deliver security awareness programs for employees.
• Lead risk assessments, maintain risk register and remediation status.
• Coordinate customer security inquiries and due diligence (SIG, CAIQ).
• Draft and improve processes for continuous security monitoring and policy adherence.
• Support end-to-end certification/recertification processes (PCI DSS, ISO 27001, NIS2).
• Conduct internal assessments to identify gaps and non-compliance.
• Assist audits with documentation, coordination, and remediation of findings.
• Serve as liaison between tech, legal, internal audit, and business units.

Skills

GRC expertise

PCI DSS

ISO 27001

GDPR

Audits

Tools

GRC tools

Job description

Glovo is seeking a proactive Security GRC Engineer to help strengthen our global security posture and navigate a rapidly evolving regulatory environment. In this multifaceted role, you will support compliance frameworks (PCI DSS, ISO 27001, NIS2), internal and external audits, drive risk assessment and remediation, and pioneer security awareness programs within our organization. Acting as a strategic bridge between technical engineering, legal, and business stakeholders, you will translate complex legal and regulatory demands into robust, actionable security controls. The ideal candidate brings deep cybersecurity risk expertise, hands‑on experience with GRC tools, and the collaborative mindset needed to foster a security‑first culture across Glovo.

Be a part of a team where you will:

• Develop, implement, and maintain security policies and procedures in line with relevant compliance frameworks (e.g., ISO 27001, NIST, PCI DSS, GDPR, NIS2, EU AI Act).

• Develop, execute and deliver security awareness programs to educate employees on best practices and compliance requirements.

• Conduct security assessment risks, recommending and implementing mitigation strategies, maintaining a risk register and monitoring the status of remediation plans.

• Coordinate and respond to customer security inquiries and due diligence questionnaires (e.g., SIG, CAIQ). Review and provide input on contract modifications related to security, data protection, and privacy.

• Propose, develop and implement processes and tools for continuous monitoring of security monitoring to ensure ongoing adherence to policies.

• Assist with the end‑to‑end security certification and re‑certification process (such as PCI DSS, ISO 27001, NIS2, among others).

• Assist with internal assessments to identify gaps, weaknesses, or non‑compliance issues within our security controls.

• Support external and internal audits by preparing documentation and coordinating with auditors, follow ups and findings remediation.

• Serve as a key liaison between technical teams, legal, internal audit, and business units to ensure a unified approach to security and compliance