The English-language job board for Spain

Technology GRC Lead

On-site in Madrid +1 location abroad·Added today (last checked 29 Oct)

Ebury

61 open roles

Apply

Our summary

Work mode: On-site, Madrid
English: Required
Experience: 3+ years

Visa options

The ad doesn’t mention sponsorship
No sponsorship mentioned, and this kind of work is rarely sponsored in Spain.

Find jobs with visa support

Skills

Requirements

What we're looking for

Experience: 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit-ideally within a regulated environment (such as financial services or fintech).
End-to-End Ownership: Proven track record of independently leading technology audits and risk programmes, rather than solely performing administrative support.
Framework Fluency: Practical working knowledge of ISO 27001, NIST, and CIS, along with a firm grasp of IT General Controls (ITGCs) across access management, change management, and IT operations.
Technical Credibility: Solid technical grounding in cloud environments (AWS/GCP/Azure), IAM, CI/CD pipelines, and secure SDLC to evaluate risk and challenge technical assertions objectively.
Executive Presence: Proven ability to present complex risk metrics, dashboards, and positions to risk committees and senior executives.
Stakeholder Management: High diplomatic assertiveness-comfortable holding senior stakeholders to remediation dates and escalating objectively when required.
Communication: Exceptional written and verbal communication in English, with the ability to bridge conversations between software engineers and non-technical auditors.

Nice to have

Hands-on experience administering modern GRC platforms (e.g., AuditBoard).
Familiarity with regulations and frameworks such as DORA, PCI DSS, or SOC 2 (Type II).
Experience implementing automated compliance monitoring or evidence pipelines.
Relevant industry certifications (e.g., CISA, CRISC, CISM, or ISO 27001 Lead Auditor).

The role

Technology GRC Lead

Location: Madrid or London

Technology is accountable to Internal Audit, Compliance, and Risk for how it manages technology risk and meets its regulatory obligations. This role directly owns that accountability.

You will lead the Technology GRC programme, maintaining Tech's overall compliance posture, providing a centralised view of risks, controls, and audit findings, and integrating GRC priorities directly into the core Technology roadmap.

Reporting to the Head of Security Engineering, you will serve as the primary liaison between Technology and internal/external oversight bodies (Internal Audit, Compliance, IT Risk), representing the department at executive risk committees.

What you'll do

Own the Programme: Drive Technology's compliance posture and establish a single source of truth for technology risk and compliance metrics.
Centralise Requests: Manage and triage incoming audit, risk, and compliance inquiries across Technology and Engineering, setting coordinated response strategies and holding stakeholders accountable.
Maintain Risk Registers: Administer the Technology risk register in AuditBoard, ensuring risk ratings, control mappings, and action plans are actively maintained and agreed upon by risk owners.
Governance & Reporting: Represent Technology at risk committees, delivering data-driven reporting on KPIs, risk positions, and remediation progress.
Audit Execution: Lead internal and external audits end-to-end-from initial scoping and evidence coordination to remediation and closure.
Remediation Tracking: Enforce agreed remediation timelines across engineering teams, escalating proactively to senior leadership when target dates slip.
Control Design: Align and define the Technology control framework against industry standards (ISO 27001, NIST, CIS) and applicable regulatory mandates.
Policy Governance: Author, update, and manage the approval lifecycle for Technology policies, standards, and standard operating procedures (SOPs).
Roadmap Alignment: Translate findings, risks, and regulatory deadlines into concrete deliverables within the Technology product and engineering backlogs.
Resource Allocation: Partner with Technology Directors during planning cycles to ensure compliance tasks are prioritised alongside feature work.
Compliance as Code: Collaborate with engineering teams to implement automated control validation and continuous evidence collection, minimising manual compliance overhead.
Vendor Assessments: Lead security and risk evaluations for technology vendors, software providers, and SaaS tools.
Contractual Standards: Define mandatory security clauses and compliance requirements during vendor onboarding and contract negotiations.

About Ebury

Ebury is a global fintech company specializing in foreign exchange, international payments, and trade finance solutions for small and medium-sized enterprises (SMEs). Founded in 2009, the company has grown into a major player in the financial services industry, processing billions in transactions annually and operating in over 20 countries. Ebury's platform combines advanced technology with expert advisory services to help businesses manage currency risk and optimize cross-border payments.

In Spain, Ebury has a significant presence with offices in Madrid and Malaga, serving as key hubs for its operations, engineering, and product teams. The company is known for its fast-paced, international work environment, with a diverse workforce representing many nationalities. For international professionals, Ebury offers opportunities in engineering, data, product, and financial crime compliance, with a strong emphasis on innovation and career growth. The company's global reach and Spanish operations make it an attractive destination for those looking to work in a dynamic fintech environment.

Industry: Fintech
Founded: 2009
Employees: 1,000–5,000
Headquarters: London, UK
In Spain: Madrid, Malaga

Good to know if you are moving

Ebury has a strong international workforce, with employees from over 60 nationalities, making it a welcoming environment for expats.
The company offers relocation support for key roles, including visa sponsorship and assistance with moving to Spain.
Spain is a major operational hub for Ebury, with offices in Madrid and Malaga, offering opportunities in engineering, product, and financial crime compliance.
Ebury provides a hybrid working model, allowing flexibility between office and remote work.
The company invests heavily in employee development, with clear career progression paths and internal mobility programs.

In their own words

About the company & team

Ebury helps ambitious businesses unlock global growth, and we take the same approach with our people. We encourage innovation and movement, collaboration and problem-solving, and foster an environment where everyone can feel they belong, are valued, supported and empowered to succeed.

If you're a collaborator who wants to help transform how businesses operate globally, get in touch - we'd love to discuss how Ebury can accelerate your career so you can shape the future.

Ebury delivers sophisticated, integrated solutions - business accounts, hedging, and financing - on a single platform with a seamless workflow. Our success is built on a simple premise and singular purpose: To help businesses operate and scale globally.

Since its founding in 2009, Ebury has always been a fast-growing leader in fintech. Today, we bring together 2000+ Eburians across nearly 70 cities and we're always looking to add to our team.

At the heart of our offering is a proprietary platform, purpose-built to help businesses seamlessly streamline and manage global cash flow. We focus on continuous product evolution and innovation to build the infrastructure for borderless growth and help our clients scale at every stage.

The opportunities at Ebury are as diverse as our people, ranging from business development to engineering roles across our tech pillars.

We believe in inclusion. We stand against discrimination in all forms and are against the intolerance of differences that makes us a modern and successful organisation. At Ebury, you can be whoever you want to be and still feel a sense of belonging no matter your story.

Additional information

Important Security Notice for Job Applicants:
Ebury only accepts applications via official Ebury channels. We will only contact you from an @ebury.com domain. Always check the emails you receive from us, and note that we will never request payment for any part of the recruitment process. Stay safe and report suspicious activity.

Notice to Recruitment Agencies and Search Firms:
Ebury does not accept unsolicited resumes, CVs, or candidate profiles from recruitment agencies or search firms without signed written Ebury recruitment terms in place for a specific role. Any unsolicited applications will be considered the sole property of Ebury. Ebury will not be responsible or liable for any placement fees or costs associated with unagreed candidate submissions or subsequent hires.

AI Transparency Statement:
Ebury uses Artificial Intelligence (AI) and automated tools to help streamline certain parts of our recruitment process, however, these tools are strictly for administrative efficiency. All hiring decisions, including application reviews, shortlisting, and final selections are evaluated and conducted by human talent acquisition professionals and hiring managers.

All open roles at Ebury