{"id":3758345,"url":"https://alion.io/job/kantox-senior-security-grc-engineer","title":"Senior Security GRC Engineer","company":{"id":53718,"name":"Kantox","domain":"kantox.com","url":"https://alion.io/company/kantox","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Barcelona, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Confluence","optional":false},{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"Jira","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"Slack","optional":false},{"name":"SOC 2","optional":false},{"name":"Agile","optional":true}],"status":"live","first_seen_at":"2026-11-04T17:41:43Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-05T03:41:53Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Senior Security GRC Engineer | Based in Barcelona\nAt Kantox, we are looking for a talented Senior Security GRC Engineer to join our Security team. This pivotal role makes sure that our security controls keep operating and keep producing evidence all year round, so that our certifications and regulatory obligations are maintained: ISO 27001, SOC 2, DORA and GDPR, with ISO 42001 possibly to come.\nAs a company that sells a payment solution, we are expected to meet a very high standard of cybersecurity and data protection. You will take ownership of the day to day operation of our control framework, so that the CISO can focus on security strategy and decisions rather than on run tasks, and so that Kantox stays compliant and responsive to its stakeholders whoever is available.\nWhat you will work on\nControl Framework Operation\nOwning the control calendar: making sure every recurring control, review, test and committee (access reviews, annual controls review, internal audit, management review, business continuity and incident response tests, security awareness) happens on schedule and is evidenced\nFollowing up with control owners across Tech, Infrastructure, Legal and the Risk Team, and reporting overdue items\nMaintaining assets, risks, applied controls and audits in CISO-Assistant, and keeping the Statement of Applicability up to date\nHandling non-conformities through to closure\nCertifications and Audits\nMaintaining ISO 27001 and driving the SOC 2 Type II readiness: closing open gaps and preparing evidence before auditors start\nSupporting DORA and GDPR obligations including ICT risk framework review, inputs to the Register of Information, and contractual clauses, as well as group or external audits\nContributing to the preparation of ISO 42001 certification if decided\nCoordinating with auditors and managing findings through to closure\nRisk and Third-Party Assessments\nConducting risk assessments following our procedure (ISO 27005, DORA Art. 6) and preparing Risk Decisions for validation by the CISO\nPerforming security assessments of new vendors and solutions, including AI tools and MCP servers\nAnalysing AI use cases submitted through our AI Champion Programme and proposing classification and treatment options\nSupport to Sales and Customers\nAnswering stakeholder and prospect security questionnaires, due diligence requests, and contractual security clauses within a defined service level, including when the CISO is unavailable\nSupporting GDPR managers across the business to ensure their GDPR duties are properly met and evidenced\nMaintaining the trust pack: certificates, SOC 2 report when available, and a reusable answer library\nGRC Engineering and Continuous Improvement\nAutomating evidence collection, review reminders, and control monitoring through integrations with Jira, CISO-Assistant, Okta, AWS, and Slack\nBuilding and improving agent-assisted workflows with human validation\nProducing KPIs and reports for the Information Security Committee, communicating clearly to non-technical audiences\n\nThe setup\nYou will join a Security team led by the CISO, working closely with the Tech organisation, Legal, the Data Protection Officer, and the Risk Team. You will also build the automation that makes this sustainable: evidence collection, review reminders and reporting, using our existing tools (CISO-Assistant, Jira, Confluence) and AI-assisted workflows with human validation.\nWho you are\nYou have 5 years of professional experience in GRC, security compliance or risk roles, ideally in a regulated environment such as financial services, payments, or SaaS. You have a proven track record of running controls and audits, and you are autonomous and rigorous: you can run a queue of requests, own deadlines, and challenge control owners constructively.\nConcretely:\n5+ years of professional experience in GRC, security compliance, or risk roles, ideally in a regulated environment such as financial services, payments, or SaaS\nHands-on experience running at least one ISO 27001 cycle and one SOC 2 Type II cycle, from gap assessment to audit\nMastery of risk assessment methodologies such as ISO 27005 or equivalent, and ability to explain risk clearly to non-security colleagues\nAbility to automate with scripts (Python or similar) and APIs to collect evidence and streamline recurring tasks\nAutonomous, rigorous, and comfortable owning a queue of requests and deadlines\nFluent in English\nNice to have:\nKnowledge of DORA and EU financial regulation\nGDPR knowledge and experience supporting data protection obligations in a regulated environment\nExperience with ISO 42001, AI governance, or third-party AI risk\nExperience with GRC platforms, ideally open source such as CISO-Assistant\nWorking knowledge of cloud security (AWS) and identity management (Okta)\nExperience with agile methodologies and collaboration tools like Jira and Confluence\nCertifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISSP\n\nWhat we offer\nCompetitive salary\nSponsored learning and development budget\nFree private health insurance\nFree language lessons (Spanish, English, French and Catalan)\nRelocation package if required\nFlexible working hours and short Fridays\nHybrid working model (4 days in office, 1 day from home)\n31 days of annual leave\nGym discounts and free sports activities\nRestaurant Ticket with monthly credit and regular cross-team lunches\nFresh fruit and unlimited coffee\nBarcelona office with 360° views of the city\n\nAbout Kantox\nWe are a 200-person fintech and a BNP Paribas company, with offices in London and Barcelona. We have grown consistently since 2011, built on a product that handles real financial complexity for clients who depend on it every day. If you want to own the security compliance function of a regulated fintech and build the automation that makes it scale, this is the role.\nKantox is an equal opportunity employer. We hire on merit and welcome applicants regardless of background, nationality, gender, age, sexual orientation, or disability status.","description_format":"text","description_chars":6035,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"Spanish","level":"All levels","optional":true},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Annual leave","Flexible schedule","Health insurance","Hybrid work","Sports activities"],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Currency Exchange & FX Payments"],"lifecycle":[{"event":"open","at":"2026-11-04T17:41:43Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":36,"reasons":["conf:1","win:early"],"computed_at":"2026-11-05T05:03:49Z"},"pay":null,"html_url":"https://alion.io/job/kantox-senior-security-grc-engineer","json_url":"https://alion.io/job/kantox-senior-security-grc-engineer.json","meta":{"generated_at":"2026-11-05T05:03:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6094,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":53718},"rest":"https://alion.io/mcp/rest/get_company?id=53718"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkantox-senior-security-grc-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkantox-senior-security-grc-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkantox-senior-security-grc-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kantox-senior-security-grc-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkantox-senior-security-grc-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3758345}},{"tool":"search_jobs","arguments":{"company":"kantox.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3758345},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}