Overview

In this role, you own Kantox’s control framework to sustain ISO 27001, SOC 2, DORA, and GDPR compliance, ensuring continuous evidence and readiness for audits. You’ll coordinate with Tech, Legal, and Risk teams to keep controls up-to-date and incidents resolved, enabling the CISO to focus on strategy. You’ll drive automation to streamline evidence collection and reporting, supporting a scalable, regulatory-first security program. This is a hands-on, cross-functional position shaping governance in a fast-moving fintech. You will contribute to potential ISO 42001 certification and strengthen third-party risk management, data protection, and audit readiness.

Compensaciones / Ventajas

- Competitive salary
- Private health insurance
- Language lessons
- Flexible hours and hybrid work
- Annual leave (31 days)
- Relocation package if required

Responsabilidades

- Own the control calendar and ensure recurring controls, reviews, tests, and committee activities happen on schedule with documented evidence
- Coordinate with control owners across Tech, Infrastructure, Legal, and Risk to address overdue items and report status
- Maintain assets, risks, applied controls, and audits in CISO-Assistant; keep the Statement of Applicability current
- Manage non-conformities through to closure
- Drive ISO 27001 readiness and support SOC 2 Type II readiness by closing gaps and collecting evidence for auditors
- Support DORA and GDPR obligations, including ICT risk framework reviews and contract-level/security clauses




- Coordinate with auditors and manage findings through closure
- Conduct risk assessments per ISO 27005 / DORA Art. 6 and prepare Risk Decisions for CISO validation
- Perform security assessments of new vendors, solutions, including AI tools and MCP servers
- Analyze AI use cases via the AI Champion Programme for classification and treatment options
- Assist Sales and Customers with security questionnaires, due diligence, and contractual security clauses
- Maintain GDPR governance across the business and evidence-tracking assets (trust pack, certificates, SOC 2 reports)
- Automate evidence collection, review reminders, and control monitoring via Jira, CISO-Assistant, Okta, AWS, Slack
- Develop agent-assisted workflows with human validation and produce KPI reports for the Information Security Committee

Requisitos principales

- 5+ years in GRC, security compliance, or risk roles, preferably in regulated environments (fintech, payments, or SaaS)
- Hands-on experience running at least one ISO 27001 cycle and one SOC 2 Type II cycle
- Mastery of ISO 27005 or equivalent risk assessment methodologies; ability to articulate risk to non-security colleagues
- Ability to automate evidence collection with scripts (Python or similar) and APIs
- Autonomous, rigorous, capable of managing multiple requests and deadlines
- Fluent in English

- Autonomy
- Rigorousness
- Cross-functional collaboration
- GRC platforms (ideally CISO-Assistant)
- Jira and Confluence
- Okta

📌 Senior Security GRC Engineer - barcelona
🏢 Kantox
📍 Barcelona