Senior Information Security Manager, based in Ebury’s Madrid office with a hybrid schedule (4 days in the office, 1 day remote per week). This role leads the global governance, risk, and compliance (GRC) program, serving as the primary architect of security frameworks and ensuring the information security management system (ISMS) remains audit-ready to support Ebury’s international growth. Responsibilities include: designing, implementing, and maturing the global GRC framework aligned with ISO 27001, NIST, GDPR, and DORA; owning the risk management lifecycle and communicating risk to business stakeholders to drive informed decisions; leading external audits and remediation to sustain multi-jurisdictional compliance; maturing Third-Party Risk Management standards and ensuring high-impact partners meet Ebury’s risk appetite; monitoring regulatory developments (e.g., EU AI Act, NIS2) and roadmapping initiatives to stay ahead of the curve; driving GRC automation and selecting platforms to enhance efficiency and resilience; advising on security-by-design for product launches and international expansions; and developing metrics-driven security awareness programs to shift organizational behavior. What you’ll need: 5+ years in information security, GRC, or risk management; strong knowledge of ISO 27001, SOC 2, GDPR, FCA/DORA, and NIST; ability to assess risks and communicate with senior stakeholders; hands-on experience implementing risk management processes, control frameworks, and security metrics; experience with GRC platforms (e.g., OneTrust); excellent collaboration and commun

Senior Information Security Manager, based in Ebury’s Madrid office with a hybrid schedule (4 days in the office, 1 day remote per week). This role leads the global governance, risk, and compliance (GRC) program, serving as the primary architect of security frameworks and ensuring the information security management system (ISMS) remains audit-ready to support Ebury’s international growth. Responsibilities include: designing, implementing, and maturing the global GRC framework aligned with ISO 27001, NIST, GDPR, and DORA; owning the risk management lifecycle and communicating risk to business stakeholders to drive informed decisions; leading external audits and remediation to sustain multi-jurisdictional compliance; maturing Third-Party Risk Management standards and ensuring high-impact partners meet Ebury’s risk appetite; monitoring regulatory developments (e.g., EU AI Act, NIS2) and roadmapping initiatives to stay ahead of the curve; driving GRC automation and selecting platforms to enhance efficiency and resilience; advising on security-by-design for product launches and international expansions; and developing metrics-driven security awareness programs to shift organizational behavior. What you’ll need: 5+ years in information security, GRC, or risk management; strong knowledge of ISO 27001, SOC 2, GDPR, FCA/DORA, and NIST; ability to assess risks and communicate with senior stakeholders; hands-on experience implementing risk management processes, control frameworks, and security metrics; experience with GRC platforms (e.g., OneTrust); excellent collaboration and commun