Tech GRC Lead: Risk, Compliance & Audit

Ebury; Madrid; On-site; EUR 90,000 - 120,000; Full time

Job summary

Ebury is seeking a Technology GRC Lead in Madrid, with 3+ years in IT/Cybersecurity GRC. You will own the programme, manage audits and risk, and coordinate with Internal Audit, Compliance, and IT Risk.

The role requires strong English communication and collaboration with engineering to automate controls. You will report to the Head of Security Engineering and act as the liaison with oversight bodies, leading risk reporting, remediation tracking, and vendor security clause definitions to support

Qualifications

• 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit in regulated environments (e.g., financial services/fintech).
• End-to-End ownership of technology audits and risk programmes, not just administrative support.
• Fluency with ISO 27001, NIST, CIS; strong ITGCs across access, change, and operations.
• Cloud experience (AWS/GCP/Azure), IAM, CI/CD pipelines, and secure SDLC to assess risk.
• Ability to present complex risk metrics to risk committees and executives.
• Strong English communication; bridges engineers and auditors.

Responsibilities

• Own Technology GRC programme and provide a central risk/compliance view.
• Centralise audit, risk and compliance inquiries across Technology and Engineering.
• Maintain Technology risk register in AuditBoard with accurate risk ratings and action plans.
• Represent Technology at risk committees and report KPIs, positions, and remediation progress.
• Lead internal and external audits from scoping to closure; ensure timely remediation.
• Define security clauses and compliance requirements in vendor onboarding/contracts.
• Collaborate with engineering for automated control validation and evidence pipelines.

Skills

IT risk management

GRC

Executive presence

English comms

Vendor risk management

Audits & risk programmes

Education

CISA

CRISC

CISM

ISO 27001 Lead Auditor

Tools

AuditBoard

Job description

Ebury is seeking a Technology GRC Lead in Madrid, with 3+ years in IT/Cybersecurity GRC. You will own the programme, manage audits and risk, and coordinate with Internal Audit, Compliance, and IT Risk.

The role requires strong English communication and collaboration with engineering to automate controls. You will report to the Head of Security Engineering and act as the liaison with oversight bodies, leading risk reporting, remediation tracking, and vendor security clause definitions to support