Overview

As a Security GRC Engineer at Glovo, you strengthen the company’s security posture across regulatory frameworks and audits. You act as a bridge between technical, legal, and business teams to translate requirements into practical controls. You’ll develop policies, run security awareness programs, and manage risk remediation with a live risk register. You’ll support certifications and audits, and drive a security-first culture in a fast-paced environment. This role offers meaningful impact through regulatory compliance and risk reduction.

Responsabilidades

- Develop and maintain security policies and procedures aligned with frameworks (ISO 27001, NIST, PCI DSS, GDPR, NIS2, EU AI Act)
- Design and deliver security awareness programs for employees
- Conduct risk assessments, recommend mitigations, and maintain remediation status
- Coordinate customer security inquiries and due diligence questionnaires (SIG, CAIQ)
- Review security-related contract modifications with legal and business units
- Implement processes and tools for continuous security monitoring and policy adherence
- Assist with end-to-end security certification processes (PCI DSS, ISO 27001, NIS2)
- Perform internal assessments to identify gaps in security controls
- Support audits with documentation and remediation tracking
- Liaise across technical, legal,



audit, and business teams to ensure a unified security/compliance approach

Requisitos principales

- BA/BS in Computer Science, Information Systems, or similar field
- Professional security certifications (CISSP, CISM, CISA, ISO 27001 Lead Implementer or equivalent)
- Minimum 5 years of relevant experience
- Strong understanding of security control frameworks (NIST, PCI DSS, GDPR, ISO 27001, NIS2)
- Hands-on experience with GRC platforms (RSA Archer, SAP GRC, Standard Fusion, Service Now, One Trust)
- Proven ability to manage multiple projects and deliver with minimal direction
- Strong problem solving, analytical, and investigative skills in a fast-paced environment
- Excellent written and verbal communication and relationship-building skills
- Experience with cloud security (AWS, Azure, GCP) and CCM
- Experience in risk quantification methods (FAIR)
- Background in delivering security awareness programs

- Collaborative mindset
- Excellent communication and interpersonal skills
- Strong problem-solving and analytical thinking
- GRC platforms (RSA Archer, SAP GRC, Standard Fusion, Service Now, One Trust)
- Security frameworks (NIST, PCI DSS, GDPR, ISO 27001, NIS2)
- Cloud security (AWS, Azure, GCP)

📌 Security GRC Engineer (Barcelona)
🏢 Glovo
📍 Barcelona