Cybersecurity Manager

At Cantabria Labs, we are committed to generating a positive impact on society and on our collaborators. And to guarantee this, we have integrated a series of programs and benefits into our culture, including:

Be part of a great leading company in its sector, whose values are Closeness, Innovation, and Entrepreneurship.

Flexiwork Policy: 6 days of teleworking per month.

Flexible start and end times.

Free private medical insurance.

Intensive working hours in summer.

Meal assistance via restaurant vouchers.

Flexible compensation program.

Onboarding program and a "Buddy" to make your integration into the Cantabria Labs family a simple, warm, and efficient experience.

Own online training platform with more than 200 training actions available

Special price on the purchase of our products.

If you are passionate about challenges... keep reading, we have a proposal for you!

1. Define, maintain, and execute the multi-year Cybersecurity Master Plan and its budget, aligned with the business and with NIS2, GDPR, and ISO 27001, and defend it before Management and the Board.

2. Develop the security regulatory framework (policies, standards, and procedures) adapted to the real procedures of the group and its subsidiaries, including NIS2 compliance in European locations.

3. Govern risk management, BIA, and business continuity, using the corporate GRC platform as a tool for recording and tracking action plans.

4. Lead plant OT security: SCADA, IT/OT segmentation, industrial directory, and compliance with 21 CFR Part 11 and EU GMP Annex 11, together with Quality and Production.

5. Direct the security of Microsoft 365, Entra ID, and Azure: conditional access, PIM, and least privilege in administrative roles, Defender, Intune, and Purview; and of OCI, JD Edwards, and Salesforce (hardening, CIS).

6. Manage security incidents and forensic analysis (phishing, BEC, malware, compromised endpoints), with expert reports and lessons learned.

7. Govern email security (SPF, DKIM, DMARC) and perimeter and remote access security (Fortinet FortiSASE / FortiGate, Front Door + WAF).

8. Integrate security into the development cycle (DevSecOps / S-SDLC): architecture review, GitHub Enterprise, automated security testing, and deployments without static secrets.

9. Define the architecture and governance of AI and the group's agentic systems (Microsoft Foundry, Copilot, Claude, MCP), with security review of connectors, skills, and AI providers.

10. Lead the evaluation of providers and third parties and the drafting of security service specifications (CTI, SOC, pentest, audit).

11. Coordinate internal and external audits and define cybersecurity KPIs/KRIs for management.

12. Drive awareness and training (simulated phishing campaigns and their monthly KPIs) for the group's employees.