Senior Security GRC Engineer - Hybrid & Flexible Hours

Kantox; Bellprat; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Free private health insurance

Hybrid working model

Relocation package

Job summary

Kantox is seeking a Senior Security GRC Engineer based in Barcelona to own the day-to-day operation of our control framework, maintain certifications (ISO 27001, SOC 2, GDPR) and support regulatory obligations. You will automate evidence collection, coordinate with auditors, and drive continuous improvement across the GRC program.

The role collaborates with Tech, Legal, and Risk teams and requires strong English communication, a proactive mindset, and experience in regulated fintech environments.

Qualifications

• 5+ years of professional experience in GRC, security compliance or risk roles in regulated environments.
• Experience running ISO 27001 cycle and SOC 2 Type II cycle from gap assessment to audit.
• Ability to automate evidence collection with scripts and APIs.
• Strong understanding of GDPR, DORA, and information risk management.
• Fluent in English and able to communicate with non-security stakeholders.

Responsibilities

• Own the control calendar and ensure recurring controls are evidenced.
• Maintain assets, risks, applied controls, and audits in the toolset.
• Coordinate with auditors and manage findings through to closure.
• Conduct risk assessments and classify AI tool risks as part of governance program.
• Support sales and customers with security questionnaires and DSAR requirements.

Skills

GRC management

ISO 27001

SOC 2

GDPR

Risk assessment

Automation scripting

English fluency

Education

Bachelor's degree in a relevant field

Tools

CISO-Assistant

Jira

Confluence

Okta

AWS

Job description

Kantox is seeking a Senior Security GRC Engineer based in Barcelona to own the day-to-day operation of our control framework, maintain certifications (ISO 27001, SOC 2, GDPR) and support regulatory obligations. You will automate evidence collection, coordinate with auditors, and drive continuous improvement across the GRC program.

The role collaborates with Tech, Legal, and Risk teams and requires strong English communication, a proactive mindset, and experience in regulated fintech environments.