Technical Governance Risk & Compliance Specialist

Ebury; Madrid; Presencial; EUR 90.000 - 120.000; Jornada completa

Descripción de la vacante

Ebury is seeking a Technology GRC Lead in Madrid, with 3+ years in IT/Cybersecurity GRC. You will own the programme, manage audits and risk, and coordinate with Internal Audit, Compliance, and IT Risk.

The role requires strong English communication and collaboration with engineering to automate controls. You will report to the Head of Security Engineering and act as the liaison with oversight bodies, leading risk reporting, remediation tracking, and vendor security clause definitions to support

Formación

• 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit in regulated environments (e.g., financial services/fintech).
• End-to-End ownership of technology audits and risk programmes, not just administrative support.
• Fluency with ISO 27001, NIST, CIS; strong ITGCs across access, change, and operations.
• Cloud experience (AWS/GCP/Azure), IAM, CI/CD pipelines, and secure SDLC to assess risk.
• Ability to present complex risk metrics to risk committees and executives.
• Strong English communication; bridges engineers and auditors.

Responsabilidades

• Own Technology GRC programme and provide a central risk/compliance view.
• Centralise audit, risk and compliance inquiries across Technology and Engineering.
• Maintain Technology risk register in AuditBoard with accurate risk ratings and action plans.
• Represent Technology at risk committees and report KPIs, positions, and remediation progress.
• Lead internal and external audits from scoping to closure; ensure timely remediation.
• Define security clauses and compliance requirements in vendor onboarding/contracts.
• Collaborate with engineering for automated control validation and evidence pipelines.

Conocimientos

IT risk management

GRC

Executive presence

English comms

Vendor risk management

Audits & risk programmes

Educación

CISA

CRISC

CISM

ISO 27001 Lead Auditor

Herramientas

AuditBoard

Descripción del empleo

Technology GRC Lead

Ebury helps ambitious businesses unlock global growth, and we take the same approach with our people. We encourage innovation and movement, collaboration and problem-solving, and foster an environment where everyone can feel they belong, are valued, supported and empowered to succeed.

• Location: Madrid or London

Role Overview

Technology is accountable to Internal Audit, Compliance, and Risk for how it manages technology risk and meets its regulatory obligations. This role directly owns that accountability.

You will lead the Technology GRC programme, maintaining Tech’s overall compliance posture, providing a centralised view of risks, controls, and audit findings, and integrating GRC priorities directly into the core Technology roadmap.

Reporting to the Head of Security Engineering, you will serve as the primary liaison between Technology and internal/external oversight bodies (Internal Audit, Compliance, IT Risk), representing the department at executive risk committees.

Key Responsibilities

Technology GRC Programme Management

• Own the Programme: Drive Technology’s compliance posture and establish a single source of truth for technology risk and compliance metrics.
• Centralise Requests: Manage and triage incoming audit, risk, and compliance inquiries across Technology and Engineering, setting coordinated response strategies and holding stakeholders accountable.
• Maintain Risk Registers: Administer the Technology risk register in AuditBoard, ensuring risk ratings, control mappings, and action plans are actively maintained and agreed upon by risk owners.
• Governance & Reporting: Represent Technology at risk committees, delivering data-driven reporting on KPIs, risk positions, and remediation progress.

Audit, Assurance & Control Frameworks

• Audit Execution: Lead internal and external audits end-to-end—from initial scoping and evidence coordination to remediation and closure.
• Remediation Tracking: Enforce agreed remediation timelines across engineering teams, escalating proactively to senior leadership when target dates slip.
• Control Design: Align and define the Technology control framework against industry standards (ISO 27001, NIST, CIS) and applicable regulatory mandates.
• Policy Governance: Author, update, and manage the approval lifecycle for Technology policies, standards, and standard operating procedures (SOPs).

Engineering Integration & Automation

• Roadmap Alignment: Translate findings, risks, and regulatory deadlines into concrete deliverables within the Technology product and engineering backlogs.
• Resource Allocation: Partner with Technology Directors during planning cycles to ensure compliance tasks are prioritised alongside feature work.
• Compliance as Code: Collaborate with engineering teams to implement automated control validation and continuous evidence collection, minimising manual compliance overhead.

Third-Party Risk Management (TPRM)

• Vendor Assessments: Lead security and risk evaluations for technology vendors, software providers, and SaaS tools.
• Contractual Standards: Define mandatory security clauses and compliance requirements during vendor onboarding and contract negotiations.

What You’ll Bring

Required Experience & Qualifications

• Experience: 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit—ideally within a regulated environment (such as financial services or fintech).
• End-to-End Ownership: Proven track record of independently leading technology audits and risk programmes, rather than solely performing administrative support.
• Framework Fluency: Practical working knowledge of ISO 27001, NIST, and CIS, along with a firm grasp of IT General Controls (ITGCs) across access management, change management, and IT operations.
• Technical Credibility: Solid technical grounding in cloud environments (AWS/GCP/Azure), IAM, CI/CD pipelines, and secure SDLC to evaluate risk and challenge technical assertions objectively.
• Executive Presence: Proven ability to present complex risk metrics, dashboards, and positions to risk committees and senior executives.
• Stakeholder Management: High diplomatic assertiveness—comfortable holding senior stakeholders to remediation dates and escalating objectively when required.
• Communication: Exceptional written and verbal communication in English, with the ability to bridge conversations between software engineers and non-technical auditors.

Desired Experience & Qualifications

• Hands-on experience administering modern GRC platforms (e.g., AuditBoard).
• Familiarity with regulations and frameworks such as DORA, PCI DSS, or SOC 2 (Type II).
• Experience implementing automated compliance monitoring or evidence pipelines.
• Relevant industry certifications (e.g., CISA, CRISC, CISM, or ISO 27001 Lead Auditor).

About Us

Ebury delivers sophisticated, integrated solutions — business accounts, hedging, and financing — on a single platform with a seamless workflow. Our success is built on a simple premise and singular purpose: To help businesses operate and scale globally.

Since its founding in 2009, Ebury has always been a fast-growing leader in fintech. Today, we bring together 2000+ Eburians across nearly 70 cities and we’re always looking to add to our team.

At the heart of our offering is a proprietary platform, purpose-built to help businesses seamlessly streamline and manage global cash flow. We focus on continuous product evolution and innovation to build the infrastructure for borderless growth and help our clients scale at every stage.

The opportunities at Ebury are as diverse as our people, ranging from business development to engineering roles across our tech pillars.

We believe in inclusion. We stand against discrimination in all forms and are against the intolerance of differences that makes us a modern and successful organisation. At Ebury, you can be whoever you want to be and still feel a sense of belonging no matter your story.

AI Transparency Statement

Ebury uses Artificial Intelligence (AI) and automated tools to help streamline certain parts of our recruitment process, however, these tools are strictly for administrative efficiency. All hiring decisions, including application reviews, shortlisting, and final selections are evaluated and conducted by human talent acquisition professionals and hiring managers.