Technological Risk Consultancy - Cybersecurity

Qualification: Degree, bachelor's, or equivalent training in Computer Science, Telecommunications, or related disciplines.

• Minimum of 2 years of experience in areas related to technological risks, cybersecurity, auditing, internal control, or compliance, preferably in medium or large companies. Experience in the financial sector will be especially valued.
• Experience working in corporate environments and collaborating with multidisciplinary teams, business areas, technology, security, legal, compliance, or audit.
• Knowledge or practical experience in technological risk management, including one of the following areas:
  • Participation in the assessment or monitoring of remediation plans, corrective actions, and improvements to the control environment.
  • Knowledge regarding vendor assessment and risk management in the digital supply chain.
  • Participation in the definition, review, or monitoring of technical and organizational controls for risk mitigation.
  • Familiarity with GRC platforms for risk, control, compliance, and reporting management.
• General knowledge of regulatory and normative frameworks in the field of technological risk or cybersecurity:
  • National and European financial regulatory environment, such as EBA, ECB, or Banco de España.
  • DORA (Digital Operational Resilience Act): general knowledge regarding digital operational resilience, ICT risk management, and third-party management.
  • NIS2 (Network and Information Security Directive).
  • Security and compliance standards and frameworks, such as ISO 27001, ENS, PCI, DSS, SWIFT CSP, or NIST CSF.
• Basic knowledge of IT governance, compliance, or auditing, and willingness to collaborate on regulatory reviews and internal or external audits.
• Ability to analyze information and collaborate in the preparation of reports and presentations on risks, metrics, and action plans.

• Training, certification, or interest in certifications related to technological risks, cybersecurity, auditing, or compliance.
• CRISC (Certified in Risk and Information Systems Control) or related training.
• CISM (Certified Information Security Manager), CISSP (Certified Information Systems Security Professional), or similar certifications.
• CISA (Certified Information Systems Auditor) or related training in systems auditing.
• Training or certification in ISO 27001.
• Training in risk management, such as ISO 31000, or in other equivalent frameworks.
• Critical thinking, curiosity, and analytical capacity.
• Good written and verbal communication skills, as well as the ability to adapt the message to different interlocutors.
• Organizational, planning and teamwork skills.
• Orientation toward quality, attention to detail, and motivation to learn and develop professionally.