Do you want to shape how SIX/BME proactively identifies and addresses cyber risk across its critical financial market infrastructure? As Head Cyber Controls, you will lead an international team of offensive security and cyber assurance specialists, driving independent technical testing, adversary simulation and Second Line oversight. Combining deep cybersecurity expertise with strategic and people leadership, you will translate complex technical risks into clear business priorities and decisions. Working closely with technology, business and security teams, senior management and external specialists, you will continuously strengthen the security posture and cyber resilience of SIX. What You Will Do
• Lead and develop the international Cyber Controls team, setting strategy, priorities and methodologies.
• Own offensive security and technical assurance, including penetration testing, red/purple teaming, adversary simulation and vulnerability research.
• Lead regulatory and specialist security testing, including the Bug Bounty Program, TIBER-EU and FINMA-driven exercises.
• Provide independent Second Line challenge,



translating technical findings into clear risks, remediation priorities and management decisions.
• Strengthen SIX’s cyber resilience by identifying emerging threats and partnering with senior management, technology, security, auditors and regulators. What You Will Bring
• Extensive cybersecurity experience, particularly in offensive security, penetration testing and technical security assurance, with proven leadership experience.
• Strong technical expertise across applications, infrastructure, cloud, adversary techniques and vulnerability management.
• Hands-on knowledge and strong interest in AI Security and its application within offensive security.
• Strong leadership, judgement and communication skills, with the ability to translate complex technical issues into business risks and decisions.
• Relevant degree or equivalent experience; certifications such as OSCP, OSEP or OSED are an advantage.
• Fluent English is required; German or Spanish is a plus.

📌 Head Cyber Controls (Madrid)
🏢 BME | Bolsas y Mercados Españoles
📍 Madrid