Want to know if this job is worth applying to?
Madrid, Comunidad de Madrid, España
Hybrid
Ebury helps ambitious businesses unlock global growth, and we take the same approach with our people. We encourage innovation and movement, collaboration and problem-solving, and foster an environment where everyone can feel they belong, are valued, supported and empowered to succeed.
If you’re a collaborator who wants to help transform how businesses operate globally, get in touch - we’d love to discuss how Ebury can accelerate your career so you can shape the future.
Location: Madrid - Hybrid - 4 days on site 1 day remote
Technology is accountable to Internal Audit, Compliance, and Risk for how it manages technology risk and meets its regulatory obligations. This role directly owns that accountability.
You will lead the Technology GRC programme, maintaining Tech’s overall compliance posture, providing a centralised view of risks, controls, and audit findings, and integrating GRC priorities directly into the core Technology roadmap.
Reporting to the Head of Security Engineering, you will serve as the primary liaison between Technology and internal/external oversight bodies (Internal Audit, Compliance, IT Risk), representing the department at executive risk committees.
Own the Programme: Drive Technology’s compliance posture and establish a single source of truth for technology risk and compliance metrics.
Centralise Requests: Manage and triage incoming audit, risk, and compliance inquiries across Technology and Engineering, setting coordinated response strategies and holding stakeholders accountable.
Maintain Risk Registers: Administer the Technology risk register in AuditBoard, ensuring risk ratings, control mappings, and action plans are actively maintained and agreed upon by risk owners.
Governance & Reporting: Represent Technology at risk committees, delivering data-driven reporting on KPIs, risk positions, and remediation progress.
Audit Execution: Lead internal and external audits end-to-end—from initial scoping and evidence coordination to remediation and closure.
Remediation Tracking: Enforce agreed remediation timelines across engineering teams, escalating proactively to senior leadership when target dates slip.
Control Design: Align and define the Technology control framework against industry standards (ISO 27001, NIST, CIS) and applicable regulatory mandates.
Policy Governance: Author, update, and manage the approval lifecycle for Technology policies, standards, and standard operating procedures (SOPs).
Roadmap Alignment: Translate findings, risks, and regulatory deadlines into concrete deliverables within the Technology product and engineering backlogs.
Resource Allocation: Partner with Technology Directors during planning cycles to ensure compliance tasks are prioritised alongside feature work.
Compliance as Code: Collaborate with engineering teams to implement automated control validation and continuous evidence collection, minimising manual compliance overhead.
Vendor Assessments: Lead security and risk evaluations for technology vendors, software providers, and SaaS tools.
Contractual Standards: Define mandatory security clauses and compliance requirements during vendor onboarding and contract negotiations.
Experience: 3+ years in IT/Cybersecurity GRC, IT Risk, or IT Audit—ideally within a regulated environment (such as financial services or fintech).
End-to-End Ownership: Proven track record of independently leading technology audits and risk programmes, rather than solely performing administrative support.
Framework Fluency: Practical working knowledge of ISO 27001, NIST, and CIS, along with a firm grasp of IT General Controls (ITGCs) across access management, change management, and IT operations.
Technical Credibility: Solid technical grounding in cloud environments (AWS/GCP/Azure), IAM, CI/CD pipelines, and secure SDLC to evaluate risk and challenge technical assertions objectively.
Executive Presence: Proven ability to present complex risk metrics, dashboards, and positions to risk committees and senior executives.
Stakeholder Management: High diplomatic assertiveness—comfortable holding senior stakeholders to remediation dates and escalating objectively when required.
Communication: Exceptional written and verbal communication in English, with the ability to bridge conversations between software engineers and non-technical auditors.
Hands-on experience administering modern GRC platforms (e.g., AuditBoard).
Familiarity with regulations and frameworks such as DORA, PCI DSS, or SOC 2 (Type II).
Experience implementing automated compliance monitoring or evidence pipelines.
Relevant industry certifications (e.g., CISA, CRISC, CISM, or ISO 27001 Lead Auditor).
About us
Ebury delivers sophisticated, integrated solutions — business accounts, hedging, and financing — on a single platform with a seamless workflow. Our success is built on a simple premise and singular purpose: To help businesses operate and scale globally.
Since its founding in 2009, Ebury has always been a fast-growing leader in fintech. Today, we bring together 2000+ Eburians across nearly 70 cities and we’re always looking to add to our team.
At the heart of our offering is a proprietary platform, purpose-built to help businesses seamlessly streamline and manage global cash flow. We focus on continuous product evolution and innovation to build the infrastructure for borderless growth and help our clients scale at every stage.
The opportunities at Ebury are as diverse as our people, ranging from business development to engineering roles across our tech pillars.
We believe in inclusion. We stand against discrimination in all forms and are against the intolerance of differences that makes us a modern and successful organisation. At Ebury, you can be whoever you want to be and still feel a sense of belonging no matter your story.
Important Security Notice for Job Applicants:
Ebury only accepts applications via official Ebury channels. We will only contact you from an @ebury.com domain. Always check the emails you receive from us, and note that we will never request payment for any part of the recruitment process. Stay safe and report suspicious activity.
Notice to Recruitment Agencies and Search Firms:
Ebury does not accept unsolicited resumes, CVs, or candidate profiles from recruitment agencies or search firms without signed written Ebury recruitment terms in place for a specific role. Any unsolicited applications will be considered the sole property of Ebury. Ebury will not be responsible or liable for any placement fees or costs associated with unagreed candidate submissions or subsequent hires.
AI Transparency Statement:
Ebury uses Artificial Intelligence (AI) and automated tools to help streamline certain parts of our recruitment process, however, these tools are strictly for administrative efficiency. All hiring decisions, including application reviews, shortlisting, and final selections are evaluated and conducted by human talent acquisition professionals and hiring managers.
