Cybersecurity GRC Consultant

• Flexibility and work-life balance. Remote work is in our DNA. We promote flexible scheduling, and we have intensive working days on Fridays and during the months of July and August. 🙌
• Continuous learning. Training in languages, technical skills, certifications, etc.
• Individualized career path, so that you are the one who decides how far you want to go. 🚀
• Flexible benefits program. Daycare, restaurant, transport vouchers, and medical insurance.
• Exclusive discounts and special conditions on technology, leisure, travel, etc. 🌟

As a GRC Cybersecurity Consultant, you will be part of SEIDOR, within our Cybersecurity area, specialized in protecting systems, networks, and data against internal and external threats.

From here, we implement preventive measures such as firewalls and antivirus, perform audits to detect vulnerabilities, and respond to security incidents, managing attacks or data breaches. Additionally, we maintain policies and protocols to ensure the confidentiality, integrity, and availability of information. We also secure operations, engineering, governance, and risk management to guarantee the security and continuity of the digital infrastructure.

Business Continuity Management (BCM):

• Participate in the evolution and maintenance of the corporate Business Continuity Management System (BCMS).
• Collaborate on Business Impact Analyses (BIA) for companies and areas within the group.
• Collaborate in the preparation and updating of:
  • Risk analyses and business continuity scenarios.
  • Business Continuity Plans (BCP).
  • Disaster Recovery Plans (DRP)
• Participate in workshops with Group companies and areas for information gathering.
• Participate in the planning and execution of continuity tests and drills.
• Maintain inventories of critical processes, systems, and dependencies.
• Training and awareness for stakeholders.

Cybersecurity risk management:

• Governance of the corporate risk management platform.
• Participate in information systems risk analysis and management processes, using recognized standards and methodologies.
• Identify, evaluate, and monitor technological risks associated with systems.
• Collaborate in the categorization of systems and the definition of security controls.
• Monitor risk treatment plans.
• Prepare risk reports and tracking dashboards.

Regulatory compliance and security maturity:

• Participate in security compliance and maturity assessments in organizations and systems.
• Collaborate in internal audits and certification processes. Support compliance with frameworks and regulations such as: ISO 27001, ISO 22301, ENS, NIS2, GDPR.
• Review and participate in security policies, procedures, and controls.

Supplier and third-party assessment:

• Participate in supplier security assessment processes.
• Analyze risks associated with third parties and outsourced services.
• Review security evidence and technical documentation from suppliers.
• Collaborate in the management of the third-party security lifecycle.
• Review of technical and security documentation.
• Collaboration in security awareness initiatives.
• Review of security requirements in contracts and commercial proposals.
• Respond to client security questionnaires.