Job&Talent
HQ - GRC Senior Analyst
- Location
- Madrid HQ, ES
- Arrangement
- Remote
- Employment type
- Full-time
- Level
- Senior
- Posted
- 3 August 2026 (about a month ago)
Checked about a month agoApplications go to the employer, never to RoleSprint
About this role
We are looking for a GRC Senior Analyst to own and scale our Governance, Risk, and Compliance function within a fast-growing product company.
What you will do • Own and lead the company’s GRC implementation across ISO 27001 and GDPR.
• Build and manage the Information Security Management System (ISMS) aligned with ISO 27001.
• Ensure GDPR compliance across all data processing activities, including data mapping, data leaks, and encryptions.
• Act as the primary point of contact for auditors and prepare the company for ISO audits.
• Identify compliance gaps and drive remediation plans with technical and non-technical teams.
• Develop governance policies, procedures, and risk management frameworks.
• Partner closely with Engineering and Security teams to embed controls into systems and SDLC processes.
• Monitor regulatory and compliance changes and translate them into actionable requirements.
Mandatory Requirements • 8+ years of experience in GRC, Risk, Compliance, or IT Audit roles
• 5+ years of strong hands-on experience with ISO 27001 and experience managing or supporting ISMS implementation.
• 3+ years of practical experience with GDPR data mapping, reviewing systems from the tech side.
• 5+ years of experience from a product tech company with global client reach in the US & EU (companies above 100 people).
• Experience working with internal and external auditors
• Very strong stakeholder management and communication skills across technical and non-technical teams.
• Fluent English
Nice to have • Familiarity with cloud environments (AWS, GCP, Azure).
• Security certifications (CISA, CISM, ISO 27001 Lead Implementer/Auditor).
• Other security experience.
#LI-OK1
Work location
- ES
Related jobs
Ready to make a decision?
This role is either worth your time or it isn’t.
Analyze the posting against your experience, see the gaps clearly, and build the right materials only if the opportunity makes sense.
Nothing is submitted automatically. You choose what happens next.
About this listing
Published on Lever under the board identifier Jobandtalent, which is the name the employer’s own job board carries. RoleSprint has not verified the company’s registered or trading name, so it is shown exactly as published rather than tidied up.
RoleSprint is not the employer and not a recruiter. Applications are made on the employer’s own site and never reach us; what RoleSprint does is help you decide whether a role is worth your time and prepare for it if it is.
Published 3 August 2026, last checked about a month ago. A posting stops being advertised here 90 days after the employer published it, and one the employer takes down is marked closed rather than quietly removed.