OverviewIn this role, you own Kantox's control framework to sustain ISO *, SOC 2, DORA, and GDPR compliance, ensuring continuous evidence and readiness for audits.
You'll coordinate with Tech, Legal, and Risk teams to keep controls up-to-date and incidents resolved, enabling the CISO to focus on strategy.
You'll drive automation to streamline evidence collection and reporting, supporting a scalable, regulatory-first security program.
This is a hands-on, cross-functional position shaping governance in a fast-moving fintech.
You will contribute to potential ISO * certification and strengthen third-party risk management, data protection, and audit readiness.
Compensaciones / BeneficiosCompetitive salary
Private health insurance
Language lessons
Adaptable hours and hybrid work
Annual leave (31 days)
Relocation package if required
ResponsabilidadesOwn the control calendar and ensure recurring controls, reviews, tests, and committee activities happen on schedule with documented evidence
Coordinate with control owners across Tech, Infrastructure, Legal, and Risk to address overdue items and report status
Maintain assets, risks, applied controls, and audits in CISO-Assistant; keep the Statement of Applicability current
Manage non-conformities through to closure
Drive ISO * readiness and support SOC 2 Type II readiness by closing gaps and collecting evidence for auditors
Support DORA and GDPR obligations, including ICT risk framework reviews and contract-level/security clauses




Coordinate with auditors and manage findings through closure
Conduct risk assessments per ISO * / DORA Art. 6 and prepare Risk Decisions for CISO validation
Perform security assessments of new vendors, solutions, including AI tools and MCP servers
Analyze AI use cases via the AI Champion Programme for classification and treatment options
Assist Sales and Customers with security questionnaires, due diligence, and contractual security clauses
Maintain GDPR governance across the business and evidence-tracking assets (trust pack, certificates, SOC 2 reports)
Automate evidence collection, review reminders, and control monitoring via Jira, CISO-Assistant, Okta, AWS, Slack
Develop agent-assisted workflows with human validation and produce KPI reports for the Information Security Committee
Requisitos principales5+ years in GRC, security compliance, or risk roles, preferably in regulated environments (fintech, payments, or SaaS)
Hands-on experience running at least one ISO * cycle and one SOC 2 Type II cycle
Mastery of ISO * or equivalent risk assessment methodologies; ability to articulate risk to non-security colleagues
Ability to automate evidence collection with scripts (Python or similar) and APIs
Autonomous, rigorous, capable of managing multiple requests and deadlines
Fluent in English
Autonomy
Rigorousness
Cross-functional collaboration
GRC platforms (ideally CISO-Assistant)
Jira and Confluence
Okta

📌 Senior Security Grc Engineer (España)
🏢 Kantox
📍 España