Technical Risk Governance & Compliance Specialist

Ebury; Madrid; Hybrid; EUR 70,000 - 110,000; Full time

Job summary

Ebury is seeking a Technology GRC Lead in Madrid to own the technology risk and compliance posture. You will centralise audits, manage risk registers, and drive improvements across governance, controls, and policy.

You’ll report to security leadership and coordinate with external auditors and risk committees. The role requires hands-on experience with ISO 27001, NIST, CIS, and cloud environments, plus strong English communication and executive presence.

Qualifications

• 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit in regulated environments.
• End-to-End ownership of technology audits and risk programmes.
• Fluent with ISO 27001, NIST, CIS; ITGCs across access/change/operations.
• Technical credibility in cloud environments and secure SDLC.
• Executive presence; ability to present risk metrics to committees.
• Strong stakeholder management and remediation accountability.
• Excellent written and verbal English communication.

Responsibilities

• Own the Technology GRC programme and deliver a single source of truth for risk metrics.
• Centralise audit, risk and compliance inquiries and coordinate response strategies.
• Maintain the Technology risk register using AuditBoard and ensure risk owners agree.
• Represent Technology at risk committees and deliver KPI reporting.
• Lead internal and external audits end-to-end from scoping to closure.
• Enforce remediation timelines and escalate when dates slip.
• Define and align control framework with ISO 27001/NIST/CIS.
• Draft and manage policy governance, SOPs, and standards.
• Align findings and deadlines to roadmaps.
• Collaborate with Tech Directors to prioritise compliance tasks.
• Implement automated control validation and evidence pipelines.

Skills

ISO 27001

NIST

CIS

Cloud (AWS/GCP/Azure)

IAM

CI/CD pipelines

Secure SDLC

ITGCs

Executive presence

Stakeholder management

English communication

Education

CISA

CRISC

CISM

ISO 27001 Lead Auditor

Tools

AuditBoard

Job description

Technical Risk Governance & Compliance Specialist

Madrid

Ebury helps ambitious businesses unlock global growth, and we take the same approach with our people. We encourage innovation and movement, collaboration and problem-solving, and foster an environment where everyone can feel they belong, are valued, supported and empowered to succeed.

If you’re a collaborator who wants to help transform how businesses operate globally, get in touch - we’d love to discuss how Ebury can accelerate your career so you can shape the future.

Technology GRC Lead

Location: Madrid - Hybrid - 4 days on site 1 day remote

Role Overview

Technology is accountable to Internal Audit, Compliance, and Risk for how it manages technology risk and meets its regulatory obligations. This role directly owns that accountability.

You will lead the Technology GRC programme, maintaining Tech’s overall compliance posture, providing a centralised view of risks, controls, and audit findings, and integrating GRC priorities directly into the core Technology roadmap.

Reporting to the Head of Security Engineering, you will serve as the primary liaison between Technology and internal/external oversight bodies (Internal Audit, Compliance, IT Risk), representing the department at executive risk committees.

Key Responsibilities

Technology GRC Programme Management

Own the Programme: Drive Technology’s compliance posture and establish a single source of truth for technology risk and compliance metrics.

Centralise Requests: Manage and triage incoming audit, risk, and compliance inquiries across Technology and Engineering, setting coordinated response strategies and holding stakeholders accountable.

Maintain Risk Registers: Administer the Technology risk register in AuditBoard, ensuring risk ratings, control mappings, and action plans are actively maintained and agreed upon by risk owners.

Governance & Reporting: Represent Technology at risk committees, delivering data-driven reporting on KPIs, risk positions, and remediation progress.

Audit, Assurance & Control Frameworks

Audit Execution: Lead internal and external audits end-to-end—from initial scoping and evidence coordination to remediation and closure.

Remediation Tracking: Enforce agreed remediation timelines across engineering teams, escalating proactively to senior leadership when target dates slip.

Control Design: Align and define the Technology control framework against industry standards (ISO 27001, NIST, CIS) and applicable regulatory mandates.

Policy Governance: Author, update, and manage the approval lifecycle for Technology policies, standards, and standard operating procedures (SOPs).

Roadmap Alignment: Translate findings, risks, and regulatory deadlines into concrete deliverables within the Technology product and engineering backlogs.

Resource Allocation: Partner with Technology Directors during planning cycles to ensure compliance tasks are prioritised alongside feature work.

Compliance as Code: Collaborate with engineering teams to implement automated control validation and continuous evidence collection, minimising manual compliance overhead.

Third-Party Risk Management (TPRM)

Vendor Assessments: Lead security and risk evaluations for technology vendors, software providers, and SaaS tools.

Contractual Standards: Define mandatory security clauses and compliance requirements during vendor onboarding and contract negotiations.

Required Experience & Qualifications

Experience: 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit—ideally within a regulated environment (such as financial services or fintech).

End-to-End Ownership: Proven track record of independently leading technology audits and risk programmes, rather than solely performing administrative support.

Framework Fluency: Practical working knowledge of ISO 27001, NIST, and CIS, along with a firm grasp of IT General Controls (ITGCs) across access management, change management, and IT operations.

Technical Credibility: Solid technical grounding in cloud environments (AWS/GCP/Azure), IAM, CI/CD pipelines, and secure SDLC to evaluate risk and challenge technical assertions objectively.

Executive Presence: Proven ability to present complex risk metrics, dashboards, and positions to risk committees and senior executives.

Stakeholder Management: High diplomatic assertiveness—comfortable holding senior stakeholders to remediation dates and escalating objectively when required.

Communication: Exceptional written and verbal communication in English, with the ability to bridge conversations between software engineers and non-technical auditors.

Desired Experience & Qualifications

Hands-on experience administering modern GRC platforms (e.g., AuditBoard).

Familiarity with regulations and frameworks such as DORA, PCI DSS, or SOC 2 (Type II).

Experience implementing automated compliance monitoring or evidence pipelines.

Relevant industry certifications (e.g., CISA, CRISC, CISM, or ISO 27001 Lead Auditor).

About us

Ebury delivers sophisticated, integrated solutions — business accounts, hedging, and financing — on a single platform with a seamless workflow. Our success is built on a simple premise and singular purpose: To help businesses operate and scale globally.

Since its founding in 2009, Ebury has always been a fast-growing leader in fintech. Today, we bring together 2000+ Eburians across nearly 70 cities and we’re always looking to add to our team.

At the heart of our offering is a proprietary platform, purpose-built to help businesses seamlessly streamline and manage global cash flow. We focus on continuous product evolution and innovation to build the infrastructure for borderless growth and help our clients scale at every stage.

The opportunities at Ebury are as diverse as our people, ranging from business development to engineering roles across our tech pillars.

We believe in inclusion. We stand against discrimination in all forms and are against the intolerance of differences that makes us a modern and successful organisation. At Ebury, you can be whoever you want to be and still feel a sense of belonging no matter your story.

Important Security Notice for Job Applicants:
Ebury only accepts applications via official Ebury channels. We will only contact you from an@ ebury.com domain. Always check the emails you receive from us, and note that we willneverrequest payment for any part of the recruitment process. Stay safe and report suspicious activity.
Notice to Recruitment Agencies and Search Firms:
Ebury does not accept unsolicited resumes, CVs, or candidate profiles from recruitment agencies or search firms without signed written Ebury recruitment terms in place for a specific role. Any unsolicited applications will be considered the sole property of Ebury. Ebury will not be responsible or liable for any placement fees or costs associated with unagreed candidate submissions or subsequent hires.
AI Transparency Statement:
Ebury uses Artificial Intelligence (AI) and automated tools to help streamline certain parts of our recruitment process, however, these tools are strictly for administrative efficiency. All hiring decisions, including application reviews, shortlisting, and final selections are evaluated and conducted by human talent acquisition professionals and hiring managers.