About Qalea We are Qalea, a fast-growing, early-stage cybersecurity startup on a mission to make digital security intuitive and accessible for every business. We've built a platform that puts simplicity, usability, and real impact at the core of cybersecurity. We've raised 1.5M€ and are backed by top-tier investors, from cybersecurity unicorn founders to leading VC firms. We're also proud to be part of the Google for Startups AI-Cybersecurity program, working alongside some of the brightest minds in product and security. We move fast, stay curious, and care deeply about what we're building. What matters to us is making an impact and building together, while enjoying the ride. The Mission We're looking for an Internal Auditor to be the independent, expert eye behind our customers' security and compliance programs. You'll audit their management systems against the standards they pursue with Qalea, from the ISO family to ENS, DORA, NIS 2, and GDPR, so they reach their certification or conformity assessment with confidence and no surprises. You won't just tick boxes. You'll turn the audit into something useful: clear findings, practical recommendations, and a path the customer can actually follow. You'll run your audits on top of the Qalea platform, using automated evidence and control monitoring to make audits faster, more rigorous, and far less painful than the spreadsheet-and-email way. This is a role with real ownership and visible impact from day one. You'll shape how Qalea does audit, from the methodology and templates to how the platform supports auditors, working shoulder-to-shoulder with our Security & Compliance and Product teams.

What You'll Do
• Plan and run internal audits of customers' management systems against the standards Qalea supports: ISO 27001, ISO 42001, ISO 9001, ENS (Basic, Medium and High), DORA, NIS 2, and GDPR.
• Cover the full cycle of each audit: scope, risk assessment, applicability of controls, control design and operation, and management review.
• Review evidence collected through the Qalea platform, run interviews and technical walkthroughs, and verify that controls are designed and operating effectively.
• Write clear, defensible audit reports: findings, nonconformities (major/minor), observations and opportunities for improvement, each tied to the exact requirement or control.
• Agree corrective action plans with customers and follow up until findings are closed,



so they are ready for the external certification audit or conformity assessment.
• Prepare customers for external audits with certification bodies and auditors, and act as their trusted contact before, during, and after the audit.
• Maintain independence and objectivity, applying audit principles from ISO 19011 and ISO/IEC 27007 and documenting your work to the standard an external auditor would expect.
• Build and improve Qalea's audit methodology: checklists, audit programs, report templates, and sampling criteria across frameworks.
• Work with Product and Engineering to make the platform better for auditors: evidence trails, control mapping, automated tests, and audit-ready reporting. Your voice shapes what we build next.
• Keep up to date on regulatory and standards changes (ENS updates, DORA technical standards, ISO revisions) and bring them into our audits. Must-Haves
• 2+ years auditing information security management systems, in an audit firm, certification body, consultancy, or internal audit team.
• Audit training or certification, such as ISO 27001 Lead Auditor or CISA.
• Solid, hands-on experience auditing ISO/IEC 27001.
• Solid, hands-on experience auditing the Esquema Nacional de Seguridad (ENS).
• Excellent communication in Spanish and English. You make complex findings simple and people feel genuinely heard. Nice-to-haves
• Experience auditing ISO/IEC 42001, DORA, or NIS 2 (we value this highly).
• Knowledge of other standards such as ISO 9001, GDPR, etc. The more of the standards we audit you know, the better, and we'll train you on the rest.
• Exposure to GRC platforms or compliance automation tools, and comfort using AI tools to work faster.
• Experience in early-stage startups or fast-paced SaaS environments. Cultural Fit
• Integrity and Independence: You call it as you see it, with evidence and respect. Your findings are never softened to please, and never delivered to wound.
• Solution-Oriented: You bring solutions, not just findings. You help customers understand what to fix first and why.
• Accountability:



You create clarity rather than expecting others to create it for you. You own the quality of every report you sign.
• Ownership Mindset: You're autonomous, decisive, and lead with confidence, including when building the method from scratch.
• Collaboration: You work seamlessly with Customer Success, Product, and Engineering, building trust and moving things forward together.
• Communication: Native-level fluency in Spanish and professional fluency in English is mandatory. Our Benefits
• ? Impact: Be part of our startup journey early, playing a key role in our growth and building something meaningful
• ? Growth: Help shape the audit and compliance culture of a Google-backed startup from the early stages.
• ? Extra days of vacation, 26 days total (23 days vacation + your Birthday + Dec 24th & 31st)
• ? Working remotely in summer and Christmas to visit family or other places
• ??‍♂️ Gympass included to support your fitness and well-being
• ? Free fresh fruit every day to help you care for your health
• ☕ Unlimited specialty coffee (Syra)
• ? A discount @ Nora food where you can also get daily menu deals
• ?️ Cool corner office in amazing Barcelona in Poblenou, surrounded by a thriving tech scene
• ? Continuous learning, including but not limited to mentoring, coaching, workshops, certifications (e.g. Lead Auditor, CISA), and opportunities to attend security conferences
• ? Team gatherings and celebrations, because we love to build connections and celebrate achievements together
• ?‍? A collaborative culture because we foster hard work, teamwork, transparency, and respect, encouraging open communication and a positive environment where your voice matters Recruitment Process
• Stage 1: Phone Screen (15 mins): quick check on experience, location, and expectations
• Stage 2: Technical & Audit Deep Dive (45 mins): we get into your real work, from ISO 27001 and ENS audits to your audit method, tooling, and why Qalea
• Stage 3: Practical Exercise (60-90 mins): a hands-on case (a sample customer's evidence and controls) where you identify findings, grade nonconformities, and explain them as you would in a closing meeting
• Stage 4: Final Cultural Fit (30 mins): a final conversation to make sure we're fully aligned on both sides before making it official
• Timeline: 2-3 weeks from first call to offer Ready to shape the future of cybersecurity?

📌 Security & Compliance Auditor (Barcelona)
🏢 Qalea
📍 Barcelona