Descripción de la oferta
Overview
As a Security GRC Engineer at Glovo, you strengthen the company’s security posture across regulatory frameworks and audits. You act as a bridge between technical, legal, and business teams to translate requirements into practical controls. You’ll develop policies, run security awareness programs, and manage risk remediation with a live risk register. You’ll support certifications and audits, and drive a security-first culture in a fast-paced environment. This role offers meaningful impact through regulatory compliance and risk reduction.
ResponsabilidadesDevelop and maintain security policies and procedures aligned with frameworks (ISO 27001, NIST, PCI DSS, GDPR, NIS2, EU AI Act)Design and deliver security awareness programs for employeesConduct risk assessments, recommend mitigations, and maintain remediation statusCoordinate customer security inquiries and due diligence questionnaires (SIG, CAIQ)Review security-related contract modifications with legal and business unitsImplement processes and tools for continuous security monitoring and policy adherenceAssist with end-to-end security certification processes (PCI DSS, ISO 27001, NIS2)Perform internal assessments to identify gaps in security controlsSupport audits with documentation and remediation trackingLiaise across technical, legal, audit, and business teams to ensure a unified security/compliance approach
Requisitos principalesBA/BS in Computer Science, Information Systems, or similar fieldProfessional security certifications (CISSP, CISM, CISA, ISO 27001 Lead Implementer or equivalent)Minimum 5 years of relevant experienceStrong understanding of security control frameworks (NIST, PCI DSS, GDPR, ISO 27001, NIS2)Hands-on experience with GRC platforms (RSA Archer, SAP GRC, StandardFusion, ServiceNow, OneTrust)Proven ability to manage multiple projects and deliver with minimal directionStrong problem solving, analytical, and investigative skills in a fast-paced environmentExcellent written and verbal communication and relationship-building skillsExperience with cloud security (AWS, Azure, GCP) and CCMExperience in risk quantification methods (FAIR)Background in delivering security awareness programsCollaborative mindsetExcellent communication and interpersonal skillsStrong problem-solving and analytical thinkingGRC platforms (RSA Archer, SAP GRC, StandardFusion, ServiceNow, OneTrust)Security frameworks (NIST, PCI DSS, GDPR, ISO 27001, NIS2)Cloud security (AWS, Azure, GCP)
