The Cybersecurity Compliance Leader will support the CISO to roll out the second line of defence, ensuring compliance with international regulations such as ISO 27001 and the ENS, and adapting security policies to the context of the firm. This strategic role is key to managing site growth and responding to increased client audits, especially in regulated sectors.

Responsibilities:

Information Security Governance

• Maintain and update the ISMS in accordance with ISO 27001 and the ENS.
• Develop and maintain security policies, procedures and standards.
• Coordinate with the CISO on security strategy.

Risk Management

• Carry out risk analysis and impact assessments.
• Identify and mitigate risks in new sites and projects.
• Manage the risk register.

Regulatory Compliance

• Ensure compliance with ISO 27001, the ENS, GDPR and Organic Law 3/2018 on the protection of personal data and guarantee of digital rights (LOPDGDD).
• Prepare and coordinate internal and external audits.
• Respond to client security questionnaires (especially in the financial sector).

Policy Alignment

• Adjust security policies to the context of the firm.
• Coordinate with legal and business departments to ensure operational alignment.

Education and Training

• Develop security awareness programmes.
• Provide regular training for employees.

Provider Management

• Assess risks of critical third parties and suppliers.
• Verify compliance with security requirements.

International Coordination

• Collaborate with the compliance and security teams in our central offices in Portugal, Colombia and Mexico to ensure regulatory and operational alignment, respecting the legal and regulatory particularities of each jurisdiction.
• Adapt security policies and procedures to local regulatory frameworks in each country.

Requirements:

• Degree in Information Security, Engineering, Law or similar.
• Three to five years of experience in regulated sectors.
• In-depth knowledge of ISO 27001, the ENS, GDPR.
• Experience in risk analysis and audits.
• Good communication skills and cross-functional work.
• Experience in a multicultural or international environment would be considered an asset
• Certifications such as CISA, ISO 27001 Lead Implementer/Auditor would be considered assets.
• High level of English (C1).