Security Consultant (Data Protection and AI)

Our challenge is to reinforce the capacity for continuous supervision, evaluation, and monitoring of the Grupo Sabadell security controls, ensuring that critical assets, sensitive data, cryptographic mechanisms, and artificial intelligence-based solutions maintain an adequate level of protection against threats, regulatory requirements, and technological evolution.

Current environments require profiles capable of combining technical judgment, a control-oriented mindset, knowledge of cryptography and data security, analytical capacity, and rigor in the generation of evidence, metrics, and reports that allow for the evaluation of the real effectiveness of the implemented controls.

The Security Strategy function has a Group scope and, among other responsibilities, is responsible for defining, executing, and supervising recurrent security evaluations, verifying the effectiveness of controls, identifying deviations, proposing remediation plans, and facilitating an objective view of the level of maturity and exposure in critical areas such as cryptography, data protection, technical controls, and artificial intelligence.

The main functions of this role include:

• Defining, executing, and maintaining recurrent security evaluations on critical controls, technological services, platforms, processes, and security capabilities.

• Supervising the correct implementation and effectiveness of controls related to cryptography, key management, certificates, secrets, encryption, tokenization, and data protection.

• Monitoring deviations, exceptions, remediation plans, maturity metrics, and evidence associated with recurrent security controls.

• Evaluating risks and controls associated with the use of artificial intelligence, including data protection, governance, traceability, secure use, third-party dependency, and regulatory compliance.

• Preparing executive and technical reports that facilitate decision-making, risk-based prioritization, and the preparation of evidence for audits, committees, and control functions.

Pursuing the following objectives:

• Ensuring a continuous, objective, and traceable view of the state of the Group's security controls, especially in critical and regulated areas.

• Defining methodologies, criteria, checklists, evidence, and metrics to evaluate the effectiveness of security controls in a homogeneous and recurrent manner.

• Driving the continuous improvement of controls related to cryptography, data security, sensitive information protection, key management, certificates, and secrets.

• Supervising the secure use of artificial intelligence-based solutions and supporting the definition of controls to mitigate specific AI and GenAI risks.

• Coordination with technology, security, risk, compliance, data protection, and audit teams to ensure adequate monitoring, remediation, and evidence.

• Providing actionable information for committees, control functions, and service owners, facilitating prioritization, accountability, and risk-based decision-making.

Contribute to reinforcing the supervision of recurrent security controls, the technical evaluation of risks, and the generation of evidence in critical areas such as cryptography, data security, sensitive information protection, and artificial intelligence.

You will act as a link between technical, security, risk, compliance, data protection, audit, and management teams, facilitating a clear view of the state of controls, deviations, residual risks, remediation plans, and action priorities.

You will collaborate with the teams responsible for platforms, applications, data, infrastructure, identity, cloud, and artificial intelligence to verify the correct implementation of controls and promote improvements proportional to the identified risk level.

You will be responsible for the following activities and functions:

• Defining, evaluating, and supervising standards and controls for cryptography, encryption, tokenization, hashing, key management, digital certificates, secrets, and the use of cryptographic algorithms appropriate to the risk level.

• Evaluating data flows, sensitive information processing, protection mechanisms, segregation, minimization, retention, traceability, and information leakage prevention controls.

• Documenting and reviewing confidential information flows and regulated data, recommending protection controls such as encryption, tokenization, masking, access control, DLP, monitoring, and traceability.

• Supervising controls associated with artificial intelligence and GenAI, including use case inventory, risk classification, data protection, vendor review, traceability, governance, monitoring, and secure use.

• Reviewing security technologies, tools, and services related to cryptography, data protection, certificate management, secrets, DLP, DSPM, CASB, AI Security, and control monitoring, proposing recommendations based on risk, effectiveness, cost, and operability.

• Defining, maintaining, and executing methodologies for recurrent control evaluation, including review criteria, scope, frequency, required evidence, metrics, and reporting.

• Supervising the degree of compliance and maturity of security controls across the different companies and geographies of the Group, identifying deviations, risks, and improvement needs.

• Developing monitoring and continuous improvement plans for controls, prioritizing actions based on risk, asset criticality, exposure, regulatory impact, and control maturity.

• Designing checklists, evaluation models, dashboards, results reports, and reusable artifacts for technical assessments and periodic reviews.

• Monitoring threats, technological changes, findings, incidents, audits, and regulatory evolution to adjust evaluation criteria and control prioritization.

• Participating in technical security reviews to verify the effective implementation of controls in applications, platforms, services, data, identities, cloud, and infrastructure.

• Validating the existence, configuration, and operation of recurrent technical controls, including preventive, detective, and corrective controls, as well as their traceability and documentary evidence.

• Coordinating with technical and control owners to ensure the monitoring of action plans, target dates, owners, residual risks, exceptions, and formal risk acceptance where applicable.

• Supporting testing, reviews, and validations of internal controls, applying maturity models, effectiveness criteria, acceptance thresholds, and evolution metrics.

• Acting as a technical point of reference in your domain, sharing best practices, evaluation criteria, results, learnings, and recommendations with security, technology, risk, and control teams.

Unit Employees: 3

Unit Growth to C/M Term: Short

· Applied cryptography, encryption, tokenization, hashing, PKI, digital certificates, HSM, key management, and secrets.

· Data security, information classification, DLP, DSPM, CASB, sensitive data protection, traceability, and information leakage prevention.

· Recurrent control evaluation, maturity models, evidence, indicators, remediation plans, and executive reporting.

· Supervision of artificial intelligence and GenAI risks and controls, including governance, data protection, traceability, secure use, and regulatory compliance.

· Knowledge of the financial sector, specific threats, operational resilience, audit, control functions, and applicable regulatory requirements.

· Analytical capacity, executive communication, transversal influence, risk-based prioritization, and preparation of clear documentation for decision-making.

· Senior Expert