The English-language job board for Spain

Cybersecurity GRC Specialist

On-site in Arrasate·Added today

Laboral Kutxa

14 open roles

Apply

Overview

Requirements

Have the right to work in Spain
No sponsorship mentioned, and this kind of work is rarely sponsored in Spain.
Work in English
English is required, per the ad.
Basque
The ad asks for Basque, or counts it in your favour.
Work on-site in Arrasate
No relocation package mentioned.
University degree
“Titulación universitaria en Ingeniería Informática, Telecomunicaciones o disciplinas afines.” — per the ad.

This job was automatically translated to English.

Pay & benefits

What you'll get

Another way of working, growing professionally and personally, so you can unleash your full potential in a sustainable and inclusive way. To achieve this:
• We promote teamwork, mutual support, and participation.
• We personalize training to develop people's skills throughout their entire professional career.
• We offer the flexibility you need to maintain a good work-life balance.
• We believe in internal talent, and for that reason you will have multiple opportunities to take on new challenges and roles.
• We will take care of you through Zainduz, our wellness program, which includes: workshops on healthy habits and emotional well-being, digital physiotherapy services, and incentives for walking or cycling to work.
• We will provide you with access to the Lagun Aro medical plan for you and your family, as well as special banking and insurance conditions.

In short, we offer inclusive and respectful work environments, we guarantee equal opportunities between men and women in workplace dynamics and professional careers, and we strive to be a benchmark in equality.

Requirements

What we're looking for

University degree in Computer Engineering, Telecommunications, or related disciplines.
Experience in Governance, Risk, and Compliance (GRC) roles within the cybersecurity field.
Experience in the implementation and maintenance of security frameworks such as ISO 27001 and ENS.
Experience with frameworks and regulations related to information security in highly regulated environments, preferably in the financial sector.
PMP (Project Management Professional) certification or equivalent experience in project management methodologies.
Experience in risk management, security audits, and coordination of cross-functional projects.
Ability to relate to technical teams, business areas, and management levels.
Analytical skills, strategic vision, and results orientation.

Nice to have

We value certifications such as CISA, CISM, CRISC, ISO 27001 Lead Auditor/Implementer, or similar.
High level of Basque and English.

The role

You will be part of the Cybersecurity area, contributing to strengthening the organization's governance, risk management, and regulatory compliance framework. You will work in close collaboration with the CISO and different business areas to ensure that cybersecurity initiatives are aligned with strategic objectives, regulatory requirements, and financial sector best practices.

What you'll do

Lead Governance, Risk, and Compliance (GRC) initiatives within the cybersecurity field.
Drive the implementation and continuous improvement of the Information Security Management System (ISO 27001 and ENS).
Identify, assess, and monitor cybersecurity risks, promoting the necessary measures for their mitigation.
Coordinate security audits and ensure compliance with applicable regulatory requirements.
Collaborate with the CISO in the definition and deployment of the cybersecurity strategy and the Security Master Plan.
Coordinate cross-functional initiatives and facilitate collaboration between areas to reinforce the organization's security.

About Laboral Kutxa

Laboral Kutxa is a Spanish financial institution deeply rooted in the Basque Country. Originally founded as a savings bank (caja de ahorros) in the mid-20th century, it has evolved into a modern banking group offering retail banking, corporate banking, insurance, and asset management services. The entity operates primarily in the Basque Country and surrounding regions, with a significant presence in the Spanish financial sector. It is part of the KutxaBank group, which is one of the largest financial groups in Spain.

For international professionals, Laboral Kutxa offers a unique opportunity to work in a cooperative banking model with a strong regional identity. The company's headquarters are in Arrasate (also known as Mondragón), a town with a strong industrial and cooperative tradition. While its main operations are in the Basque Country, it has a growing digital and technology division, creating roles in cybersecurity, data governance, and international payments. The company's culture is deeply rooted in Basque values, and it is an excellent place for those interested in understanding the Spanish financial system from a regional perspective. They are actively seeking talent in areas like IT risk auditing, data governance, and crisis management, and they offer internships and entry-level positions for recent graduates in business, economics, and law.

Industry: Banking
Founded: 1959
Employees: 3,000–5,000
Headquarters: Arrasate, Spain
In Spain: Arrasate, Bilbao, Donostia-San Sebastián
Website: laboralkutxa.com

Good to know if you are moving

The company is headquartered in Arrasate (also known as Mondragón), a town in the Basque Country, not in a major city like Madrid or Barcelona.
The working language is primarily Spanish and Basque, so a good level of Spanish is essential for integration.
The company has a strong social and community focus, which is a core part of its identity as a savings bank.
They are actively recruiting for IT and cybersecurity roles, as well as for recent graduates in business, economics, and law for their offices in Bizkaia and Gipuzkoa.
As a cooperative bank, it offers a different work culture compared to large commercial banks, with a strong emphasis on its social mission.

All open roles at Laboral Kutxa