Third-Party Risk & IT Risk Specialist

Now, let us tell you what we can offer you. Here is everything waiting for you!

We offer you stability from day one, with a permanent contract, so you can focus on what motivates you.
Our working hours are flexible, and you will have the possibility to work more than 50% of your time remotely.
You will enjoy an additional compensation package, as our model includes a pension plan and meal allowance; you can also request flexible remuneration to access other services such as childcare, transport card, or training support.
You will have up to 30 working days of vacation to disconnect and come back with recharged batteries (including vacation days, personal days, and company holidays). Additionally, if you work at the Madrid or Barcelona headquarters, you will have access to a gym where you can work out on your own or attend guided classes.
You will participate in an international and cross-functional environment with the opportunity to work on projects with different teams and countries.
We care about your development, which is why we offer an interesting 'a la carte' continuous training package to help you boost your professional career.

And if you are left wanting to know more and you wonder: what will my day-to-day be like in this project?

Functionally lead third-party risk management from an IT Security perspective and actively collaborate in the management and monitoring of the organization's technology and security risks.

The position will have a weight of approximately 65% in Third-Party Risk Management and 35% in IT Security Risk Management, acting as the functional TPRM reference within Security and coordinating transversally with Procurement, Business Owners, IT, Security, Group, and other relevant functions.

We are looking for a profile primarily oriented towards GRC and Risk Management, but with the necessary technical knowledge to understand security risks, analyze evidence, interact with IT teams, and perform challenges when necessary.

This is a position without direct people management, but with an important component of functional leadership, transversal coordination, and influence.

Third-Party Risk Management - IT Security | ~65%

• Functionally lead the Third-Party Risk Management process from an IT Security perspective, acting as the main Security reference for this matter.
• Coordinate and monitor the Third-Party Risk pipeline, establishing priorities and maintaining a consolidated view of assessments, reassessments, open risks, remediation actions, exceptions, and expirations.
• Coordinate security assessments for new third parties and periodic reassessments of existing providers, ensuring their correct execution in accordance with the corporate methodologies and processes defined by Group.
• Analyze the results of security assessments and identify risks, control gaps, and remediation needs.
• Monitor identified risks and remediation plans, coordinating primarily with Procurement, Business Owners, and Risk Owners.
• Manage and monitor exceptions and risk acceptance processes, coordinating their proper documentation, compensatory measures, approval by the corresponding Risk Owner, and expiration or review dates.
• Maintain a consolidated view of third-party risk, providing visibility into main exposures, pending assessments, open risks, remediation plans, exceptions, and overdue items.
• Monitor the KPIs/KRIs associated with the Third-Party Risk Management process and prepare the necessary reporting for Management and governance forums.
• Identify opportunities for improvement, optimization, and automation of the process, respecting the TPRM methodologies, policies, and models defined at the Group level.

IT Security Risk Management | ~35%

• Actively participate in the management and monitoring of IT Security risks, collaborating with the rest of the members of the Security function.
• Locally coordinate the application of IT Risk methodologies and processes defined by Group, facilitating their implementation and execution within the organization.
• Participate in the identification, assessment, registration, and monitoring of technology and cybersecurity risks.
• Monitor remediation plans, deadlines, and commitments with Risk Owners, identifying deviations and escalating when necessary.
• Manage and monitor exceptions and risk acceptances, ensuring their proper documentation, governance, approval, and review.
• Participate as an IT Security Risk specialist in relevant technology projects, providing a risk-based vision in initiatives such as new applications, technological transformation, cloud, migrations, or integrations.
• Perform periodic monitoring of technology risk KPIs/KRIs and prepare reporting on their evolution.
• Participate in periodic assessments and transversal exercises related to IT Risk and Security Risk.