Senior InfoSec & IT Risk Analyst

Admiral Europe Tech | Admiral Group; Sevilla; On-site; EUR 75,000 - 110,000; Full time

Job summary

Admiral Europe Tech is seeking a Senior InfoSec & IT Risk Analyst to lead the risk governance framework and act as Risk Champion across business and technology units. You will oversee 360° risk assessments, KRIs, risk registers, and multi-cloud security governance (AWS, Azure, GCP) to keep operations secure and compliant.

The ideal candidate combines deep IT risk expertise with a process-automation mindset and the ability to translate complex security data into executive-level insights for

Qualifications

• Strong background in IT/InfoSec risk frameworks, 360° risk assessments, risk registers, RALs, and KRI management.
• Experience with enterprise Risk Management tools and GRC platforms (e.g., Pentana, Ideagen Risk).
• Familiarity with cloud security controls across AWS, Azure, and GCP; CSPM tools like WIZ.
• Exposure to vulnerability management lifecycles, DevOps security pipelines, and baselines.
• Excellent written and verbal English and Spanish; translate risks for executives.
• Analytical mindset to define efficiency metrics and automate risk reporting.

Responsibilities

• Execute annual 360° risk assessments across core systems, driving dynamic and semi-automated risk evaluation workflows.
• Design, deliver, and evolve High Level Risk Registers aligned with regulatory standards and Group Risk baselines.
• Manage the lifecycle of Risk Acceptance Letters (RALs) and ad-hoc risk assessments, establishing operational metrics.
• Lead Risk Champion for InfoSec and IT, coordinating risk mitigation strategies across domains.
• Oversee KRIs reporting, incidents, threats, and vulnerabilities; conduct root-cause analyses on high-risk threats.
• Enforce remediation plans for critical vulnerabilities and drive DevOps pipeline maturity.
• Oversee Security Exceptions management, malware controls, and remediation for legacy systems.
• Oversee security governance across multi-cloud environments (AWS, Azure, GCP) and CSPM posture.

Skills

Risk & Compliance

GRC Tools & Systems

Cloud Security Governance

Technical Risk Understanding

Communication & Tailoring

Process Automation & Metrics

Tools

Pentana

Ideagen Risk

WIZ

Job description

Role Overview

We are seeking a Senior InfoSec & IT Risk Analyst who combines deep information security and IT risk management expertise with a modern, process-automation mindset. In this role, you will lead the InfoSec & IT risk governance framework, serving as a primary Risk Champion across business and technology units. You will oversee the execution of 360° risk assessments, Key Risk Indicators (KRIs), high level Risk Registers, and multi-cloud security governance (AWS, Azure, GCP), ensuring our operations remain secure, compliant, and transparent. The ideal candidate acts as a strategic bridge between technical security engineering, group risk controllers, and executive leadership.

Key Responsibilities

InfoSec & IT Risk Framework Management

• Execute annual 360° risk assessments across core systems, driving the transition toward dynamic and semi-automated risk evaluation workflows.
• Design, deliver, and continuously evolve High Level Risk Registers in close alignment with regulatory standards and Group Risk baselines.
• Manage the lifecycle of Risk Acceptance Letters (RALs) and ad-hoc risk assessments, establishing operational metrics to measure and reduce "time-to-market".
• Act as the lead Risk Champion for InfoSec and IT, coordinating risk mitigation strategies and controls across business and technical domains.
  
  

Security Governance, KRIs & Vulnerability Oversight

• Evolve, calculate, and report Key Risk Indicators (KRIs) in partnership with the Group Risk Team, leveraging GRC and risk management tools (e.g., Pentana/Ideagen).
• Oversee regular reporting on Security Incidents, Threats, and Vulnerabilities, conducting root-cause analyses on high-risk security threats.
• Enforce realistic remediation plans for critical vulnerabilities (Class A and B) and drive the maturity of DevOps pipeline weakness management.
• Oversee Security Exceptions management, malware controls, and remediation plans for unsupported and legacy systems.
  
  

Cloud Security Governance

• Validate and monitor security hardening rules and posture across multi-cloud environments (AWS, Azure, GCP) using cloud security platforms (e.g., WIZ).
• Maintain high security baselines across production clouds, ensuring compliance targets (>95%) are consistently achieved across critical cloud accounts.
• Define and implement Cloud RACI matrices to establish clear cloud security governance across Cloud Engineering, DevOps, and Security teams.
  
  

Stakeholder Management & Risk Communication

• Tailor risk reports and executive communications to non-technical audiences, translating complex security data into clear business insights.
• Serve as the central liaison between IT/InfoSec engineering, Operational Risk Controllers, Group Risk, and external auditors.
• Lead risk mitigation initiatives, tracking deliverables, key SLAs, and milestones to provide progress updates to leadership.
  
  

Requirements:

Key Qualifications & Skills

• Risk & Compliance Core: Strong background in IT/InfoSec risk frameworks, 360° risk assessments, risk registers, RALs, and KRI management within complex or corporate environments.
• GRC Tools & Systems: Practical experience using enterprise Risk Management tools and GRC platforms (e.g., Pentana, Ideagen Risk).
• Cloud Security Governance: Familiarity with cloud security controls across AWS, Azure, and GCP, including hands-on exposure to Cloud Security Posture Management (CSPM) tools like WIZ.
• Technical Risk Understanding: Exposure to vulnerability management lifecycles, DevOps security pipeline weaknesses, and infrastructure security baselines.
• Communication & Tailoring: Exceptional written and verbal communication skills in English (and Spanish), with a proven track record of translating technical risks into clear executive language for non-technical stakeholders.
• Process Automation & Metrics: An analytical mindset focused on defining efficiency metrics (SLAs, time-to-market) and streamlining manual risk reporting processes.