Senior Security GRC Engineer — Hybrid (Barcelona)

Kantox; Barcelona; Hybrid; EUR 90.000 - 120.000; Vollzeit

Benefits dieser Stelle

Free private health insurance

Relocation package if required

Flexible working hours

Hybrid model 4 days in office, 1 day W

31 days annual leave

Gym discounts

Zusammenfassung

Kantox is seeking a Senior Security GRC Engineer to own the control framework operations, ensure ongoing compliance, and drive certifications such as ISO 27001, SOC 2 Type II, and GDPR readiness. You will work closely with the CISO and Risk teams to automate evidence collection and reporting.

The role requires 5+ years in GRC or risk in regulated environments, strong ISO 27001/SOC 2 experience, and proficiency with automation via scripts and APIs.

Qualifikationen

• 5+ years of professional experience in GRC, security compliance, or risk roles, ideally in regulated environments like financial services, payments, or SaaS.
• Hands-on experience running ISO 27001 and SOC 2 Type II cycles from gap assessment to audit.
• Mastery of risk assessment methodologies such as ISO 27005, with ability to explain risk to non-security colleagues.
• Ability to automate evidence collection and recurring tasks using scripts and APIs.
• Fluent in English; knowledge of GDPR/DORA in EU financial regulation is a plus.

Aufgaben

• Operate the control calendar and ensure recurring controls, reviews, and audits are evidenced.
• Coordinate with control owners across Tech, Legal, and Risk teams and report overdue items.
• Maintain assets, risks, and audits in the tracking tools; keep SoA up to date.
• Handle non-conformities through to closure and support audits and certifications.
• Automate evidence collection and reporting using Jira, CISO-Assistant, Okta, AWS, and Slack.
• Produce KPIs and reports for the Information Security Committee.

Kenntnisse

GRC

ISO 27001

SOC 2

Risk management

Security controls

English fluency

Ausbildung

ISO 27001 Lead Implementer

CISA

CISSP

Tools

CISO-Assistant

Jira

Confluence

Okta

AWS

Jobbeschreibung

Kantox is seeking a Senior Security GRC Engineer to own the control framework operations, ensure ongoing compliance, and drive certifications such as ISO 27001, SOC 2 Type II, and GDPR readiness. You will work closely with the CISO and Risk teams to automate evidence collection and reporting.

The role requires 5+ years in GRC or risk in regulated environments, strong ISO 27001/SOC 2 experience, and proficiency with automation via scripts and APIs.