OverviewIn this role, you own Kantox's control framework to sustain ISO , SOC 2, DORA, and GDPR compliance, ensuring continuous evidence and readiness for audits.

You'll coordinate with Tech, Legal, and Risk teams to keep controls up-to-date and incidents resolved, enabling the CISO to focus on strategy.

You'll drive automation to streamline evidence collection and reporting, supporting a scalable, regulatory-first security program.

This is a hands-on, cross-functional position shaping governance in a fast-moving fintech.

You will contribute to potential ISO certification and strengthen third-party risk management, data protection, and audit readiness.

Compensaciones / BeneficiosCompetitive salary

Private health insurance

Language lessons

Versátil hours and hybrid work

Annual leave (31 days)

Relocation package if required

ResponsabilidadesOwn the control calendar and ensure recurring controls, reviews, tests, and committee activities happen on schedule with documented evidence

Coordinate with control owners across Tech, Infrastructure, Legal, and Risk to address overdue items and report status

Maintain assets, risks, applied controls, and audits in CISO-Assistant; keep the Statement of Applicability current

Manage non-conformities through to closure

Drive ISO readiness and support SOC 2 Type II readiness by closing gaps and collecting evidence for auditors

Support DORA and GDPR obligations, including ICT risk framework reviews and contract-level/security clauses





Coordinate with auditors and manage findings through closure

Conduct risk assessments per ISO / DORA Art. 6 and prepare Risk Decisions for CISO validation

Perform security assessments of new vendors, solutions, including AI tools and MCP servers

Analyze AI use cases via the AI Champion Programme for classification and treatment options

Assist Sales and Customers with security questionnaires, due diligence, and contractual security clauses

Maintain GDPR governance across the business and evidence-tracking assets (trust pack, certificates, SOC 2 reports)

Automate evidence collection, review reminders, and control monitoring via Jira, CISO-Assistant, Okta, AWS, Slack

Develop agent-assisted workflows with human validation and produce KPI reports for the Information Security Committee

Requisitos principales5+ years in GRC, security compliance, or risk roles, preferably in regulated environments (fintech, payments, or SaaS)

Hands-on experience running at least one ISO cycle and one SOC 2 Type II cycle

Mastery of ISO or equivalent risk assessment methodologies; ability to articulate risk to non-security colleagues

Ability to automate evidence collection with scripts (Python or similar) and APIs

Autonomous, rigorous, capable of managing multiple requests and deadlines

Fluent in English

Autonomy

Rigorousness

Cross-functional collaboration

GRC platforms (ideally CISO-Assistant)

Jira and Confluence

Okta

📌 Senior Security Grc Engineer - Barcelona
🏢 Kantox
📍 Barcelona