Information Security Director, Spain (Web3)

Location: Spain-based, Madrid, with remote work; full local tax/legal residency in Spain is required

Company

hirify.global Europe S.L. is preparing for authorization under the EU Markets in Crypto-Assets Regulation as a crypto-asset service provider in Spain.

What you will do

• Lead the ICT risk management framework in line with DORA, MiCA, CNMV, ESMA, and EBA requirements.
• Supervise delegated cloud infrastructure, software development, security operations, and other ICT services provided by group entities.
• Manage technology and cyber risks, including annual Business Impact Analysis and ICT risk assessment reviews.
• Act as the local authority for major security incidents and coordinate regulatory notifications to the CNMV.
• Oversee third-party ICT security, contractual SLAs, recovery objectives, operational resilience testing, and threat-led penetration testing.
• Govern crypto-asset custody security, secure SDLC controls, DLT testing, and the centralized inventory of ICT assets supporting Spanish and EU operations.

Requirements

• University degree in Computer Science, Computer Engineering, Cybersecurity, or a related technical field.
• Experience building cybersecurity frameworks and complying with EU financial-sector regulations, including DORA, MiCA, and PCI DSS.
• Knowledge of vulnerability management, threat monitoring, SIEM/SOC platforms, cryptographic protocols, key ceremonies, and secure private-key storage.
• Experience with MPC, HSM, multisig signing workflows, secure software development, and resilience testing.
• Native or bilingual Spanish and professional working English are required.
• Full local tax and legal residency in Spain is required.

Nice to have

• Industry certifications such as CISM, CISSP, CRISC, or CISA.

Culture & Benefits

• Remote work arrangement within the Spain-based role.
• Direct interaction with CNMV and the Bank of Spain on cybersecurity, DORA, and DLT supervision.
• Decision-making authority over technology actions affecting EU operations.
• Work across group entities and critical ICT service providers in a hub-and-spoke operating model.