About The Company
About The Company
Prefer the flexibility of remote work?
You’re welcome to work remotely. Looking for some social energy?
Our hybrid setup gives you the option to connect and work alongside teammates at our hubs in Valencia, Barcelona, Madrid and Murcia . Remote when you want flexibility. Our clients expect proof that we protect their data and processes, and this role provides it. We are looking for an Information Security Manager in our Governance, Risk and Compliance function to own and continuously improve Maisa’s security compliance program. Plan the audits, budget and tooling for each addition.
Run the Information Security Management System (ISMS) day to day: policies, control ownership, the internal audit program and management review. Turn requirements from every framework into one set of practical controls with clear owners, tests and evidence, automated in our compliance management system wherever possible.
Coordinate control implementation and continuous assessment across Engineering, Security, Platform, Operations, People, Legal, Finance and other business functions. Own the company‑wide information security and AI risk management process, including the risk register, treatment plans, risk owner sign‑off and periodic reviews.
Run third‑party risk management (TPRM): vendor due diligence and assessments at onboarding, contract security review with Legal, and periodic reassessment.
Lead the response to enterprise customer security assessments, due‑diligence questionnaires, client audits and requests for compliance documentation.
Keep recurring processes running and producing evidence: security awareness, employee compliance, access reviews, incident and change management, business continuity and secure development. Work with technical teams to verify that controls are effective across AWS, Kubernetes, identity systems, endpoints and CI/CD.
5+ years in information or cyber security, most of it in governance, risk and compliance.
~ Good understanding of ISO 27001:2022, ISO 27002 controls,



SOC 2 Trust Services Criteria, ISMS operation, risk assessment, and control testing.
~ Experience designing and documenting controls, rather than only collecting evidence for controls designed by someone else.
~ Strong understanding of information security governance and common security processes such as:
~ secure software development;
~ logging and monitoring;
~ Ability to work directly with technical teams and understand enough of their systems to determine whether a control is actually effective.
~ Strong project‑management and organizational skills, with the ability to coordinate control owners across multiple teams.
~ Excellent written communication skills and the ability to produce clear policies, procedures, risk assessments, audit responses, and executive‑level reporting.
~ Experience working in a B2B SaaS or enterprise software company, preferably serving regulated clients such as banks.
Experience with cloud‑native environments, particularly AWS and Kubernetes.
Familiarity with GDPR and European information security and privacy requirements, plus frameworks such as ISO/IEC 42001, ISO/IEC 27701 or the EU AI Act.
Experience building or maturing a compliance or ISMS program from an early stage.
Within your first months, you will have a clear view of Maisa’s existing controls, gaps, risks, evidence, and audit readiness, with accountable owners and remediation plans for outstanding work. Certifications run continuously as the company, product and infrastructure evolve, and new frameworks build on existing controls rather than starting over.
Control owners understand what is expected from them and why.
This role sits at the intersection of security, engineering, and business operations. You will be expected to challenge weak controls when necessary, but also to understand the operational cost of compliance requirements and work with teams to find proportionate solutions.
By submitting this application, I agree that my personal data will be collected, processed, and retained by the company solely for the purposes of managing and assessing my candidacy.
#

📌 Chief Information Security Officer (País Vasco)
🏢 Maisa
📍 País Vasco