Security GRC Engineer — Health Data Compliance & ISO 27001

Alan; País Vasco; Híbrido; EUR 90.000 - 120.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Remote work flexibility

Collaborative culture

Descripción de la vacante

Alan is building a globally scalable governance, risk and compliance function. This role owns the ISO 27001 ISMS, leads regulatory and privacy matters, and partners with Legal, Internal Audit, and Risk to ensure a solid security program.

You will drive risk cartography, control ownership, and audit cycles across multiple regulators and countries. You will also automate evidence collection, configure GRC tooling, and read architecture to identify control gaps.

Formación

• Experience leading ISO 27001 ISMS audits and certifications.
• Ability to translate regulatory requirements into concrete controls.
• Proven track record in security governance, risk & compliance across complex orgs.
• Strong collaboration with Legal, Internal Audit, and Risk functions.
• Experience with risk mapping frameworks (EBIOS RM) and audit cycles.

Responsabilidades

• Own ISO 27001 ISMS program, audit planning, and certification cycles.
• Translate regulatory requirements (DORA, RGPD, NIS2) into actionable controls.
• Lead security risk mapping and tie outcomes to business decisions.
• Define and manage the controls framework with cross-functional ownership.
• Lead vendor security assessments and third-party risk management.
• Drive automation of evidence collection and continuous compliance routines.

Conocimientos

ISO 27001

DORA

HDS

NIS2

EBIOS RM

GRC tooling

CSPM

policy-as-code

architecture review

risk communication

Herramientas

ServiceNow GRC

Archer

CISO Assistant

OPA

SCP

Descripción del empleo

Alan is building a globally scalable governance, risk and compliance function. This role owns the ISO 27001 ISMS, leads regulatory and privacy matters, and partners with Legal, Internal Audit, and Risk to ensure a solid security program.

You will drive risk cartography, control ownership, and audit cycles across multiple regulators and countries. You will also automate evidence collection, configure GRC tooling, and read architecture to identify control gaps.