Technology GRC Lead

• Location: Madrid or London

Role Overview

Technology is accountable to Internal Audit, Compliance, and Risk for how it manages technology risk and meets its regulatory obligations. This role directly owns that accountability.

You will lead the Technology GRC programme, maintaining Tech’s overall compliance posture, providing a centralised view of risks, controls, and audit findings, and integrating GRC priorities directly into the core Technology roadmap.

Reporting to the Head of Security Engineering, you will serve as the primary liaison between Technology and internal/external oversight bodies (Internal Audit, Compliance, IT Risk), representing the department at executive risk committees.

Key Responsibilities

Technology GRC Programme Management

• Own the Programme: Drive Technology’s compliance posture and establish a single source of truth for technology risk and compliance metrics.

• Centralise Requests: Manage and triage incoming audit, risk, and compliance inquiries across Technology and Engineering, setting coordinated response strategies and holding stakeholders accountable.

• Maintain Risk Registers: Administer the Technology risk register in AuditBoard, ensuring risk ratings, control mappings, and action plans are actively maintained and agreed upon by risk owners.

• Governance & Reporting: Represent Technology at risk committees, delivering data-driven reporting on KPIs, risk positions, and remediation progress.

Audit, Assurance & Control Frameworks

• Audit Execution: Lead internal and external audits end-to-end—from initial scoping and evidence coordination to remediation and closure.

• Remediation Tracking: Enforce agreed remediation timelines across engineering teams, escalating proactively to senior leadership when target dates slip.

• Control Design: Align and define the Technology control framework against industry standards (ISO 27001, NIST, CIS) and applicable regulatory mandates.

• Policy Governance: Author, update, and manage the approval lifecycle for Technology policies, standards, and standard operating procedures (SOPs).

Engineering Integration & Automation

• Roadmap Alignment: Translate findings, risks, and regulatory deadlines into concrete deliverables within the Technology product and engineering backlogs.

• Resource Allocation: Partner with Technology Directors during planning cycles to ensure compliance tasks are prioritised alongside feature work.

• Compliance as Code: Collaborate with engineering teams to implement automated control validation and continuous evidence collection, minimising manual compliance overhead.

Third-Party Risk Management (TPRM)

• Vendor Assessments: Lead security and risk evaluations for technology vendors, software providers, and SaaS tools.

• Contractual Standards: Define mandatory security clauses and compliance requirements during vendor onboarding and contract negotiations.

What You’ll Bring

Required Experience & Qualifications

• Experience: 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit—ideally within a regulated environment (such as financial services or fintech).

• End-to-End Ownership: Proven track record of independently leading technology audits and risk programmes, rather than solely performing administrative support.

• Framework Fluency: Practical working knowledge of ISO 27001, NIST, and CIS, along with a firm grasp of IT General Controls (ITGCs) across access management, change management, and IT operations.

• Technical Credibility: Solid technical grounding in cloud environments (AWS/GCP/Azure), IAM, CI/CD pipelines, and secure SDLC to evaluate risk and challenge technical assertions objectively.

• Executive Presence: Proven ability to present complex risk metrics, dashboards, and positions to risk committees and senior executives.

• Stakeholder Management: High diplomatic assertiveness—comfortable holding senior stakeholders to remediation dates and escalating objectively when required.

• Communication: Exceptional written and verbal communication in English, with the ability to bridge conversations between software engineers and non-technical auditors.

Desired Experience & Qualifications

• Hands-on experience administering modern GRC platforms (e.g., AuditBoard).

• Familiarity with regulations and frameworks such as DORA, PCI DSS, or SOC 2 (Type II).

• Experience implementing automated compliance monitoring or evidence pipelines.

• Relevant industry certifications (e.g., CISA, CRISC, CISM, or ISO 27001 Lead Auditor).