Overview

In this role you strengthen Glovo’s security posture within a fast-paced, regulated environment. You’ll bridge technical, legal, and business teams to translate regulatory demands into robust controls and drive awareness across the company. You will lead risk assessment, audits, and the end-to-end certification process to support ongoing compliance. Join a security-focused team shaping governance across cloud and on-premises environments while enabling business growth.

Responsabilidades

- Develop, implement, and maintain security policies and procedures aligned with ISO 27001, NIST, PCI DSS, GDPR, NIS2, EU AI Act
- Develop and deliver security awareness programs for employees
- Conduct risk assessments, implement mitigations, maintain a risk register and remediation tracking
- Coordinate with customers and respond to due diligence questionnaires (e.g., SIG, CAIQ)
- Provide input on security-related contract modifications
- Propose and implement processes for continuous security monitoring
- Assist with security certification/re-certification (PCI DSS, ISO 27001, NIS2)
- Identify gaps/non-compliance through internal assessments
- Prepare documentation and coordinate audits, track findings and remediation
- Serve as liaison between tech, legal, internal audit,



and business units to align security and compliance

Requisitos principales

- BA/BS in Computer Science, Information Systems, or similar
- Professional security certifications (CISSP, CISM, CISA, ISO 27001 Lead Implementer or equivalent)
- Minimum 5 years of relevant experience
- Strong knowledge of NIST, PCI DSS, GDPR, ISO 27001, NIS2
- Hands-on experience with GRC platforms (RSA Archer, SAP GRC, StandardFusion, ServiceNow, OneTrust)
- Ability to manage multiple projects with minimal direction
- Analytical and problem-solving skills in a fast-paced environment
- Excellent written and verbal communication and stakeholder management
- Experience with cloud compliance (AWS, Azure, GCP) and CCM
- Knowledge of risk quantification methods (e.g., FAIR)
- Experience delivering security awareness programs
- Nice-to-haves: automation skills (e.g., Python), BCP/DR planning, EU AI Act familiarity and AI security frameworks

- team collaboration
- communications
- relationships
- GRC platforms (RSA Archer, SAP GRC, StandardFusion, ServiceNow, OneTrust)
- security controls frameworks (NIST, PCI DSS, ISO 27001, NIS2)
- cloud security (AWS, Azure, GCP)

📌 Security grc engineer (Barcelona)
🏢 Glovo
📍 Barcelona