FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in GRC, security compliance, and risk management, with a strong focus on ISO 27001 and SOC 2 Type II cycles. Proficient in automating processes and conducting risk assessments while ensuring compliance with GDPR and DORA regulations.
Highest-signal resume keywords
ISO 27001 Cycle ManagementSOC 2 Type II Audit ExperienceRisk Assessment MethodologiesGRC Platform ExperienceGDPR Compliance Knowledge
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Risk AssessmentISO 27001SOC 2 Type IIPython ScriptingISO 42001DORA ComplianceAI GovernanceCloud SecurityIdentity ManagementAgile Methodologies
Soft Skills
AutonomousRigorousDeadline ManagementCommunication with Non-Technical Audiences
Tools & Technologies
CISO-AssistantJiraConfluenceAWSOktaSlack
Certifications & Qualifications
ISO 27001 Lead ImplementerISO 27001 Lead AuditorCISACRISCCISSP
Industry Keywords
GRCSecurity ComplianceRisk ManagementFinancial ServicesPaymentsSaaSRegulated Environment
Tech Stack
Tools & technologiesAWSCloudOpen SourcePython
About the role
Key responsibilities & impact- Own the control calendar, ensuring recurring controls, reviews, tests, and committees occur on schedule and are evidenced
- Follow up with control owners across Tech, Infrastructure, Legal, and Risk, and report overdue items
- Maintain assets, risks, applied controls, and audits in CISO-Assistant, and keep the Statement of Applicability up to date
- Handle non-conformities through closure
- Maintain ISO 27001 and drive SOC 2 Type II readiness by closing gaps and preparing audit evidence
- Support DORA and GDPR obligations, including ICT risk framework review, Register of Information inputs, contractual clauses, and audits
- Contribute to preparation for possible ISO 42001 certification
- Coordinate with auditors and manage findings through closure
- Conduct risk assessments using ISO 27005, DORA Article 6, or equivalent methodologies
- Prepare Risk Decisions for CISO validation
- Perform security assessments of new vendors and solutions, including AI tools and MCP servers
- Analyze AI use cases and propose classification and treatment options
- Answer stakeholder and prospect security questionnaires, due diligence requests, and contractual security clauses within defined service levels
- Support GDPR managers in meeting and evidencing their duties
- Maintain the trust pack, including certificates, SOC 2 report when available, and reusable answer library
- Automate evidence collection, review reminders, and control monitoring through Jira, CISO-Assistant, Okta, AWS, and Slack integrations
- Build and improve agent-assisted workflows with human validation
- Produce KPIs and reports for the Information Security Committee and communicate with non-technical audiences
- Work with the CISO-led Security team, Tech, Legal, the Data Protection Officer, and Risk Team
Requirements
What you’ll need- 5+ years of professional experience in GRC, security compliance, or risk roles, ideally in a regulated environment such as financial services, payments, or SaaS
- Hands-on experience running at least one ISO 27001 cycle and one SOC 2 Type II cycle, from gap assessment to audit
- Mastery of risk assessment methodologies such as ISO 27005 or equivalent, and ability to explain risk clearly to non-security colleagues
- Ability to automate with scripts (Python or similar) and APIs to collect evidence and streamline recurring tasks
- Autonomous, rigorous, and comfortable owning a queue of requests and deadlines
- Fluent in English
- Knowledge of DORA and EU financial regulation
- GDPR knowledge and experience supporting data protection obligations in a regulated environment
- Experience with ISO 42001, AI governance, or third-party AI risk
- Experience with GRC platforms, ideally open source such as CISO-Assistant
- Working knowledge of cloud security (AWS) and identity management (Okta)
- Experience with agile methodologies and collaboration tools like Jira and Confluence
- Certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISSP
Benefits
Comp & perks- Sponsored learning and development budget
- Free private health insurance
- Free language lessons (Spanish, English, French and Catalan)
- Relocation package if required
- Flexible working hours and short Fridays
- Hybrid working model (4 days in office, 1 day from home)
- 31 days of annual leave
- Gym discounts and free sports activities
- Restaurant Ticket with monthly credit and regular cross-team lunches
- Fresh fruit and unlimited coffee