When you join us, you'll be part of a general team harnessing the power of scientific testing and data-driven insights to build a healthier future.

The Information Security Governance

Specialist owns the governance backbone of the security programme: policy, control framework design, compliance, and audit assurance. This role translates security strategy into structured, auditable, and operationally realistic governance artefacts (e.g.: exception registers, policy suites, control frameworks, audit programmes) and works across the business to embed them into everyday operation. Develop, maintain, and periodically review information security policies, standards, and procedures aligned to ISO 27001 and other recognised cybersecurity frameworks.

Maintain the security governance calendar (policy reviews, management reviews). Maintain the control framework catalogue, mapping controls to ISO 27001 Annex A, NIST CSF, and CIS Controls, and flag control gaps for risk assessment by the Information Security Risk Specialist.



Partner with the Information Security Risk Specialist to ensure exceptions and control gaps are risk-assessed and formally risk-accepted by the appropriate owner before a waiver is granted.

Map controls to regulatory and contractual obligations (GDPR, PCI-DSS, HIPAA, sector-specific requirements as applicable). Maintain a defensible audit trail for control operation and governance decisions. Produce executive-ready reporting: governance and compliance dashboards, programme status updates, board and committee papers.

Act as a trusted point of contact for business units seeking governance guidance on new initiatives. Contribute governance input to post-incident reviews and remediation programmes, ensuring lessons learned convert into control or policy change. Support the broader team on cross-functional initiatives (e.g. data protection projects, security awareness) as priorities require.

To be eligible to work at ALS you must be a Citizen or Permanent Resident of the country you are applying for, or either hold or be able to obtain, a valid working visa.

📌 Information Governance Security Consultant (Madrid)
🏢 ALS
📍 Madrid