Senior Security GRC Engineer (Fintech)

Location: Barcelona, Spain; hybrid working with 4 days in the office and 1 day from home

Company

hirify.global is a 200-person fintech and BNP Paribas company providing a payment solution, with offices in London and Barcelona.

What you will do

• Own the control calendar, recurring reviews, tests, committees, evidence collection, Statement of Applicability, assets, risks, audits, and non-conformities.
• Maintain ISO 27001 and drive SOC 2 Type II readiness, prepare audit evidence, coordinate with auditors, and close findings.
• Support DORA and GDPR obligations, including ICT risk framework reviews, the Register of Information, contractual clauses, and external or group audits.
• Conduct ISO 27005 or DORA-based risk assessments, prepare Risk Decisions, and assess vendors, solutions, AI tools, and MCP servers.
• Answer security questionnaires and due diligence requests, support GDPR managers, and maintain the trust pack and reusable answer library.
• Automate evidence collection, reminders, monitoring, reporting, and AI-assisted workflows using scripts, APIs, Jira, CISO-Assistant, Okta, AWS, Slack, and Confluence.

Requirements

• 5+ years of professional experience in GRC, security compliance, or risk roles, ideally in financial services, payments, or SaaS.
• Hands-on experience running at least one ISO 27001 cycle and one SOC 2 Type II cycle from gap assessment through audit.
• Mastery of risk assessment methodologies such as ISO 27005 or equivalent, with the ability to explain risk to non-security colleagues.
• Ability to automate evidence collection and recurring tasks with Python or similar scripting and APIs.
• Autonomous, rigorous, and comfortable owning request queues, deadlines, and constructive challenges to control owners.
• Fluent English required.

Nice to have

• Knowledge of DORA, EU financial regulation, GDPR, or data protection obligations in a regulated environment.
• Experience with ISO 42001, AI governance, third-party AI risk, or GRC platforms such as CISO-Assistant.
• Working knowledge of AWS cloud security, Okta identity management, agile methodologies, Jira, and Confluence.
• ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISSP certification.

Culture & Benefits

• Hybrid working model with 4 office days and 1 home-working day, flexible hours, and short Fridays.
• 31 days of annual leave and free private health insurance.
• Sponsored learning and development budget and free Spanish, English, French, and Catalan lessons.
• Relocation package if required, gym discounts, free sports activities, restaurant ticket credit, and cross-team lunches.
• Barcelona office with city views, fresh fruit, and unlimited coffee.