Information Security Governance Specialist

About the role

ALST is hiring an Information Security Governance Specialist in Madrid. The role owns the governance backbone of the security programme: policy, control framework design, compliance and audit assurance. It turns security strategy into structured, auditable and operationally realistic governance artefacts such as exception registers, policy suites, control frameworks and audit programmes, and works across the business to embed them in everyday operations.

Key responsibilities

• Develop, maintain and periodically review information security policies, standards and procedures aligned to ISO 27001 and other recognised cybersecurity frameworks.
• Maintain the security governance calendar (policy reviews, management reviews).
• Support the design and evolution of the security strategy and multi-year security programme roadmap.
• Administer the security exception/waiver process end-to-end: intake, documentation, approval routing and tracking of time-bound remediation commitments through to closure.
• Maintain the control framework catalogue, mapping controls to ISO 27001 Annex A, NIST CSF and CIS Controls, and flag control gaps for risk assessment by the Information Security Risk Specialist.
• Partner with the Information Security Risk Specialist so that exceptions and control gaps are risk-assessed and formally risk-accepted before a waiver is granted.
• Coordinate internal and external audits and certification cycles (e.g. ISO 27001), including evidence collection and remediation tracking.
• Map controls to regulatory and contractual obligations (GDPR, PCI-DSS, HIPAA, sector-specific requirements as applicable).
• Maintain a defensible audit trail for control operation and governance decisions.
• Produce executive-ready reporting: governance and compliance dashboards, programme status updates and board and committee papers.
• Act as a trusted point of contact for business units seeking governance guidance on new initiatives.
• Contribute governance input to post-incident reviews and remediation programmes, and support cross-functional initiatives such as data protection projects and security awareness.

Required profile

• Citizen or permanent resident of the country of application, or able to obtain a valid working visa.
• Ability to apply online with a resume and cover letter.