The English-language job board for Spain

Senior Security GRC Engineer

Hybrid in Barcelona·Added yesterday (last checked 4 Nov)

Kantox

5 open roles

Apply

Our summary

Work mode: Hybrid, Barcelona
Relocation: A relocation package
English: Required
Experience: 5+ years
Benefits: Private health insurance, meal vouchers, gym access

Visa options

The ad doesn’t mention sponsorship
No sponsorship mentioned, and this kind of work is rarely sponsored in Spain.

Find jobs with visa support

Skills

Nice to have

Requirements

What we're looking for

Who you are

You have 5 years of professional experience in GRC, security compliance or risk roles, ideally in a regulated environment such as financial services, payments, or SaaS. You have a proven track record of running controls and audits, and you are autonomous and rigorous: you can run a queue of requests, own deadlines, and challenge control owners constructively.

Concretely:

5+ years of professional experience in GRC, security compliance, or risk roles, ideally in a regulated environment such as financial services, payments, or SaaS
Hands-on experience running at least one ISO 27001 cycle and one SOC 2 Type II cycle, from gap assessment to audit
Mastery of risk assessment methodologies such as ISO 27005 or equivalent, and ability to explain risk clearly to non-security colleagues
Ability to automate with scripts (Python or similar) and APIs to collect evidence and streamline recurring tasks
Autonomous, rigorous, and comfortable owning a queue of requests and deadlines
Fluent in English

Nice to have

Knowledge of DORA and EU financial regulation
GDPR knowledge and experience supporting data protection obligations in a regulated environment
Experience with ISO 42001, AI governance, or third-party AI risk
Experience with GRC platforms, ideally open source such as CISO-Assistant
Working knowledge of cloud security (AWS) and identity management (Okta)
Experience with agile methodologies and collaboration tools like Jira and Confluence
Certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISSP

Pay & benefits

What you'll get

What we offer

Competitive salary
Sponsored learning and development budget
Free private health insurance
Free language lessons (Spanish, English, French and Catalan)
Relocation package if required
Flexible working hours and short Fridays
Hybrid working model (4 days in office, 1 day from home)
31 days of annual leave
Gym discounts and free sports activities
Restaurant Ticket with monthly credit and regular cross-team lunches
Fresh fruit and unlimited coffee
Barcelona office with 360° views of the city

The role

At Kantox, we are looking for a talented Senior Security GRC Engineer to join our Security team. This pivotal role makes sure that our security controls keep operating and keep producing evidence all year round, so that our certifications and regulatory obligations are maintained: ISO 27001, SOC 2, DORA and GDPR, with ISO 42001 possibly to come.

As a company that sells a payment solution, we are expected to meet a very high standard of cybersecurity and data protection. You will take ownership of the day to day operation of our control framework, so that the CISO can focus on security strategy and decisions rather than on run tasks, and so that Kantox stays compliant and responsive to its stakeholders whoever is available.

What you'll do

Control Framework Operation

Owning the control calendar: making sure every recurring control, review, test and committee (access reviews, annual controls review, internal audit, management review, business continuity and incident response tests, security awareness) happens on schedule and is evidenced
Following up with control owners across Tech, Infrastructure, Legal and the Risk Team, and reporting overdue items
Maintaining assets, risks, applied controls and audits in CISO-Assistant, and keeping the Statement of Applicability up to date
Handling non-conformities through to closure

Certifications and Audits

Maintaining ISO 27001 and driving the SOC 2 Type II readiness: closing open gaps and preparing evidence before auditors start
Supporting DORA and GDPR obligations including ICT risk framework review, inputs to the Register of Information, and contractual clauses, as well as group or external audits
Contributing to the preparation of ISO 42001 certification if decided
Coordinating with auditors and managing findings through to closure

Risk and Third-Party Assessments

Conducting risk assessments following our procedure (ISO 27005, DORA Art. 6) and preparing Risk Decisions for validation by the CISO
Performing security assessments of new vendors and solutions, including AI tools and MCP servers
Analysing AI use cases submitted through our AI Champion Programme and proposing classification and treatment options

Support to Sales and Customers

Answering stakeholder and prospect security questionnaires, due diligence requests, and contractual security clauses within a defined service level, including when the CISO is unavailable
Supporting GDPR managers across the business to ensure their GDPR duties are properly met and evidenced
Maintaining the trust pack: certificates, SOC 2 report when available, and a reusable answer library

GRC Engineering and Continuous Improvement

Automating evidence collection, review reminders, and control monitoring through integrations with Jira, CISO-Assistant, Okta, AWS, and Slack
Building and improving agent-assisted workflows with human validation
Producing KPIs and reports for the Information Security Committee, communicating clearly to non-technical audiences

About Kantox

Kantox is a fintech company specializing in automated foreign exchange (FX) management and international payment solutions for businesses. The company provides a software platform that automates currency risk management, helping companies transact in multiple currencies and hedge their FX exposure. Kantox operates globally, serving clients across Europe, the UK, and the Americas, with a significant presence in the financial technology sector.

Kantox was founded in Barcelona, Spain, and its main Spanish office remains in Barcelona, which is also the company's global headquarters. The company has a strong engineering and product culture, with a diverse, international team. For international professionals, Kantox offers a dynamic and fast-paced environment in a leading fintech hub, with opportunities to work on complex problems in FX and payments, and a culture that values innovation and collaboration.

Industry: Fintech
Founded: 2011
Employees: 100–500
Headquarters: Barcelona, Spain
In Spain: Barcelona

Good to know if you are moving

Kantox is headquartered in Barcelona, Spain, making it a direct option for professionals looking to relocate to Spain.
The company's working language is English, which facilitates the integration of international talent.
Kantox offers a modern, tech-driven environment with a focus on product development and engineering.
The company has a global client base, providing exposure to international markets and challenges.
Barcelona is a major European tech hub, offering a high quality of life and a vibrant international community.

In their own words

About the company & team

The setup

You will join a Security team led by the CISO, working closely with the Tech organisation, Legal, the Data Protection Officer, and the Risk Team. You will also build the automation that makes this sustainable: evidence collection, review reminders and reporting, using our existing tools (CISO-Assistant, Jira, Confluence) and AI-assisted workflows with human validation.

About Kantox

We are a 200-person fintech and a BNP Paribas company, with offices in London and Barcelona. We have grown consistently since 2011, built on a product that handles real financial complexity for clients who depend on it every day. If you want to own the security compliance function of a regulated fintech and build the automation that makes it scale, this is the role.

Additional information

Kantox is an equal opportunity employer. We hire on merit and welcome applicants regardless of background, nationality, gender, age, sexual orientation, or disability status.

All open roles at Kantox