Internal Auditor (Non-Financial)

About the role

Mercuryo, a Spanish crypto-asset service provider, is looking for a full-time Internal Auditor to set up and run its independent internal audit function. Reporting directly to the Board of Directors, the auditor provides objective assurance over governance, regulatory compliance, operational processes and internal controls of the Spanish entity. The role manages the audit programme independently, with limited day-to-day direction.

Key responsibilities

• Create and maintain a risk-based annual internal audit calendar for Board approval, plan audit activities and track progress
• Audit policies, procedures and controls for currency, approval and regulatory alignment, including governance, onboarding, AML/CFT, Travel Rule, transaction monitoring, complaints, conflicts of interest, regulatory reporting, outsourcing, business continuity, customer protection and information security (ISO 27001)
• Gather evidence with Operations, Product, Risk, Compliance and InfoSec, conduct interviews, sample testing and keep traceable working papers
• Write evidence-based reports with risk ratings and root causes, agree action plans with management and present findings to the Board
• Maintain the Internal Audit Charter and templates, support regulatory inspections and monitor regulatory developments

Required profile

• University degree or professional qualification in internal audit, law, compliance, risk, technology, financial regulation or a related field
• 4+ years in internal audit, compliance assurance, control testing or regulatory risk in financial services, fintech, payments or crypto
• Strong experience reviewing policies and processes against legal, regulatory and control requirements
• Spanish and English fully fluent

Required skills

• Strong knowledge of MiCA, AML/CFT and Travel Rule; practical understanding of DORA and outsourcing
• Familiarity with ISMS and ISO 27001; ISO 27001 audit experience a plus
• Experience with regulatory inspections (CNMV, Banco de España, SEPBLAC or equivalent) a plus
• Certifications such as CIA, CISA, CESCOM, CAMS or ISO 27001 Lead Auditor advantageous but not essential
• Knowledge of crypto-assets, blockchain analytics, custody or digital-asset transaction monitoring a plus

What we offer

• Competitive market-rate salary and performance-based incentives
• 22 days annual leave plus 6 company days and bank holidays
• Health insurance, maternity and paternity leave support, and an extensive benefits programme
• Flexible schedule, remote work options and modern offices and co-working spaces
• Working equipment, professional development and training