Information Security Manager (Hybrid/Remote, Spain)

About the role

Nebeus is looking for an experienced Information Security Manager to define, implement and maintain its information security framework and ICT risk management strategy. The role is hybrid/remote based in Spain and works closely with IT, Compliance, the DPO and external partners to protect digital assets and ensure regulatory compliance.

Key responsibilities

• Define, implement and maintain security policies, procedures and controls.
• Conduct ICT risk assessments and develop mitigation plans.
• Ensure compliance with regulations and frameworks such as DORA, ISO 27001 and ENS.
• Coordinate internal and external security audits.
• Oversee access management, backups and core cybersecurity controls.
• Lead incident response and manage the security incident framework.
• Assess and manage third‑party and vendor risks.
• Promote security awareness through training and internal communication.
• Chair the ICT Committee and report security posture to the Board and Executive Committee.
• Maintain the ICT risk register and align it with enterprise risk management.
• Guide security architecture decisions across cloud infrastructure, applications and integrations.
• Oversee Business Continuity and Disaster Recovery programmes.

Required profile

• 2–5 years of experience in information security, cybersecurity or IT risk.
• Practical knowledge of security frameworks such as ISO 27001, ENS or equivalent.
• Experience working in regulated environments.
• Ability to work independently with a structured, proactive approach.
• Strong business‑oriented mindset and excellent communication skills.
• Fluency in English and Spanish.

Required skills

• ISO 27001
• ENS
• DORA
• Cloud security architecture
• Incident response
• Access management

What we offer

• Full‑time permanent contract
• 25 days holiday
• Shorter work day on Fridays
• Health insurance package
• Brand new MacBook
• Training reimbursement