Senior Security GRC Engineer | Based in Barcelona
At Kantox, we are looking for a talented Senior Security GRC Engineer to join our Security team. This pivotal role makes sure that our security controls keep operating and keep producing evidence all year round, so that our certifications and regulatory obligations are maintained: As a company that sells a payment solution, we are expected to meet a very high standard of cybersecurity and data protection. You will take ownership of the day to day operation of our control framework, so that the CISO can focus on security strategy and decisions rather than on run tasks, and so that Kantox stays compliant and responsive to its stakeholders whoever is available.

Control Framework Operation
Owning the control calendar: making sure every recurring control, review, test and committee (access reviews, annual controls review, internal audit, management review, business continuity and incident response tests, security awareness) happens on schedule and is evidenced
Following up with control owners across Tech, Infrastructure, Legal and the Risk Team, and reporting overdue items
Maintaining assets, risks, applied controls and audits in CISO-Assistant, and keeping the Statement of Applicability up to date
Supporting DORA and GDPR obligations including ICT risk framework review, inputs to the Register of Information, and contractual clauses, as well as group or external audits
Performing security assessments of new vendors and solutions, including AI tools and MCP servers
Automating evidence collection, review reminders, and control monitoring through integrations with Jira, CISO-Assistant, Okta, AWS, and Slack
Producing KPIs and reports for the Information Security Committee,



communicating clearly to non-technical audiences

You will join a Security team led by the CISO, working closely with the Tech organisation, Legal, the Data Protection Officer, and the Risk Team. You will also build the automation that makes this sustainable: evidence collection, review reminders and reporting, using our existing tools (CISO-Assistant, Jira, Confluence) and AI-assisted workflows with human validation.
You have a proven track record of running controls and audits, and you are autonomous and rigorous: you can run a queue of requests, own deadlines, and challenge control owners constructively.
Ability to automate with scripts (Python or similar) and APIs to collect evidence and streamline recurring tasks
~ Fluent in English

GDPR knowledge and experience supporting data protection obligations in a regulated environment
Working knowledge of cloud security (AWS) and identity management (Okta)
Experience with agile methodologies and collaboration tools like Jira and Confluence
Sponsored learning and development budget

- Free private health insurance
- Free language lessons (Spanish, English, French and Catalan)
- Relocation package if required
- Versátil working hours and short Fridays
- Hybrid working model (4 days in office, 1 day from home)
- Fresh fruit and unlimited coffee
- Barcelona office with 360° views of the city

We are a 200-person fintech and a BNP Paribas company, with offices in London and Barcelona. We have grown consistently since 2011, built on a product that handles real financial complexity for clients who depend on it every day. If you want to own the security compliance function of a regulated fintech and build the automation that makes it scale, this is the role.

📌 Senior Security Engineer(Hybrid) (Barcelona)
🏢 Kantox
📍 Barcelona