Tech GRC Lead: Risk, Compliance & Audit

Ebury; Madrid; Hybrid; EUR 70,000 - 110,000; Full time

Job summary

Ebury is seeking a Technology GRC Lead in Madrid to own the technology risk and compliance posture. You will centralise audits, manage risk registers, and drive improvements across governance, controls, and policy.

You’ll report to security leadership and coordinate with external auditors and risk committees. The role requires hands-on experience with ISO 27001, NIST, CIS, and cloud environments, plus strong English communication and executive presence.

Qualifications

• 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit in regulated environments.
• End-to-End ownership of technology audits and risk programmes.
• Fluent with ISO 27001, NIST, CIS; ITGCs across access/change/operations.
• Technical credibility in cloud environments and secure SDLC.
• Executive presence; ability to present risk metrics to committees.
• Strong stakeholder management and remediation accountability.
• Excellent written and verbal English communication.

Responsibilities

• Own the Technology GRC programme and deliver a single source of truth for risk metrics.
• Centralise audit, risk and compliance inquiries and coordinate response strategies.
• Maintain the Technology risk register using AuditBoard and ensure risk owners agree.
• Represent Technology at risk committees and deliver KPI reporting.
• Lead internal and external audits end-to-end from scoping to closure.
• Enforce remediation timelines and escalate when dates slip.
• Define and align control framework with ISO 27001/NIST/CIS.
• Draft and manage policy governance, SOPs, and standards.
• Align findings and deadlines to roadmaps.
• Collaborate with Tech Directors to prioritise compliance tasks.
• Implement automated control validation and evidence pipelines.

Skills

ISO 27001

NIST

CIS

Cloud (AWS/GCP/Azure)

IAM

CI/CD pipelines

Secure SDLC

ITGCs

Executive presence

Stakeholder management

English communication

Education

CISA

CRISC

CISM

ISO 27001 Lead Auditor

Tools

AuditBoard

Job description

Ebury is seeking a Technology GRC Lead in Madrid to own the technology risk and compliance posture. You will centralise audits, manage risk registers, and drive improvements across governance, controls, and policy.

You’ll report to security leadership and coordinate with external auditors and risk committees. The role requires hands-on experience with ISO 27001, NIST, CIS, and cloud environments, plus strong English communication and executive presence.