Security GRC Lead — ISO 27001, PCI DSS, NIS2

Delivery Hero (Glovo); Barcelona; On-site; EUR 60,000 - 100,000; Full time

Job summary

Glovo seeks a proactive Security GRC Engineer to strengthen global security posture and navigate regulatory requirements. You will drive risk assessments, audits, and remediation, bridging technical, legal, and business teams to implement robust controls.

The role emphasizes hands-on GRC tooling, security policy development, and security awareness programs to foster a security-first culture across Glovo. Experience with frameworks like ISO 27001, NIST, PCI DSS, GDPR, and NIS2 is essential.

Qualifications

• BA/BS in Computer Science, Information Systems, or similar.
• Professional security certifications (CISSP, CISM, CISA, ISO 27001 Lead Implementer or equivalent).
• Minimum 5 years of experience in the field or in a related area.
• Strong understanding of security control frameworks (NIST, PCI DSS, GDPR, ISO 27001, NIS2).
• Hands-on experience with GRC platforms (RSA Archer, SAP GRC, ServiceNow, OneTrust).

Responsibilities

• Develop, implement, and maintain security policies and procedures aligned with ISO 27001, NIST, PCI DSS, GDPR, NIS2, and EU AI Act.
• Develop and deliver security awareness programs to educate employees on compliant practices.
• Conduct risk assessment activities, recommend mitigations, and maintain a remediation tracker.
• Coordinate and respond to customer security inquiries and due diligence questionnaires (e.g., SIG, CAIQ).
• Review contract changes related to security, data protection, and privacy.
• Propose and implement processes for continuous security monitoring and policy adherence.
• Assist with certification and re-certification efforts (PCI DSS, ISO 27001, NIS2).
• Assist internal assessments to identify gaps or non-compliance in security controls.
• Support audits with documentation and coordination with auditors, including remediation follow-ups.
• Act as liaison among tech, legal, internal audit, and business units for unified security/compliance.

Skills

Security risk

Audits & compliance

Stakeholder collaboration

Security awareness

Cloud security

GRC tooling

Regulatory frameworks

Risk assessment

Contract input

Project management

Education

BA/BS in CS or IS

Tools

RSA Archer

SAP GRC

ServiceNow

OneTrust

StandardFusion

Job description

Glovo seeks a proactive Security GRC Engineer to strengthen global security posture and navigate regulatory requirements. You will drive risk assessments, audits, and remediation, bridging technical, legal, and business teams to implement robust controls.

The role emphasizes hands-on GRC tooling, security policy development, and security awareness programs to foster a security-first culture across Glovo. Experience with frameworks like ISO 27001, NIST, PCI DSS, GDPR, and NIS2 is essential.