Security Analyst

• Bachelor's Degree
• 5-10 years of experience in roles related to GRC in Information Security
• Intermediate English (B2)
• Knowledge: CPDSE (Certified Data Privacy Solution Engineer) or CISM (Certified Information Security Manager) ISACA or similar, ISO27001 Lead Auditor, Cyber Security Foundation

• Be part of a great leading company in its sector.
• Flexible compensation program.
• Onboarding program to make your integration a simple, efficient, and warm experience.
• Own online training platform with more than 50 available training courses.
• Special prices on the purchase of different products and services.
• Corporate sports activities to promote well-being.

To ensure that the organization effectively and balancedly manages aspects related to governance, risk management, and regulatory compliance within the field of information security.

The Governance, Risk, and Compliance (GRC) area aims to establish the Information Security management framework, ensuring that policies, processes, and controls are aligned with Grup Mediapro's strategic objectives, regulatory requirements, and the level of risk assumed by the organization.

Their main responsibilities are:

- Information Security Governance: Define and maintain the governance framework through policies, standards, procedures, and organizational structures that ensure effective information security management.

- Risk Management: Identify, analyze, evaluate, and treat information security risks, promoting the implementation of adequate controls and supervising the acceptance and monitoring of residual risks.

- Regulatory Compliance: Ensure compliance with applicable legislation, regulations, and standards, including frameworks such as ISO/IEC 27001, the National Security Framework (ENS), and coordination with the Privacy area for compliance with GDPR and other related regulations.

- Third-Party Management: Evaluate and supervise risks associated with providers, partners, and third parties, including approval processes, security assessments, and monitoring of established controls.

- Policies, Regulations, and Document Management: Prepare, maintain, and review the documentation of the Information Security Management System (ISMS), ensuring it remains updated and aligned with internal and external requirements.

- Audits and Assessments: Plan and coordinate internal and external audits, compliance assessments, and periodic reviews of security controls, driving the implementation of corrective and improvement actions.

- Awareness and Training: Promote a security culture through training programs, awareness campaigns, and communication directed at employees and collaborators.

- Continuous Improvement: Drive the continuous improvement of the ISMS through the monitoring of indicators, the review of implemented controls, incident analysis, and adaptation to new threats, technologies, and regulatory requirements.

- Reporting and Governance: Prepare metrics and executive reports on the state of security, the level of compliance, risk evolution, and the effectiveness of controls to facilitate decision-making by Management.