Security GRC Engineer

About the role

Glovo, part of the Delivery Hero Group, is looking for a proactive Security GRC Engineer in Barcelona to strengthen its global security posture and navigate a rapidly evolving regulatory environment. You will support compliance frameworks such as PCI DSS, ISO 27001 and NIS2, run internal and external audits, drive risk assessment and remediation, and lead security awareness programs. The role acts as a bridge between technical engineering, legal and business stakeholders.

Key responsibilities

• Develop, implement and maintain security policies and procedures aligned with ISO 27001, NIST, PCI DSS, GDPR, NIS2 and the EU AI Act.
• Run security awareness programs to educate employees on best practices and compliance requirements.
• Conduct security risk assessments, recommend and implement mitigations, maintain a risk register and track remediation plans.
• Respond to customer security inquiries and due diligence questionnaires (e.g. SIG, CAIQ).
• Review and give input on contract changes related to security, data protection and privacy.
• Propose and implement continuous monitoring processes and tools.
• Assist with security certification and re-certification (PCI DSS, ISO 27001, NIS2) and internal gap assessments.
• Support internal and external audits by preparing documentation and coordinating with auditors, and follow up on findings.
• Liaise between technical teams, legal, internal audit and business units.

Required profile

• BA/BS in Computer Science, Information Systems or similar.
• Professional security certifications (CISSP, CISM, CISA, ISO 27001 Lead Implementer or equivalent).
• Minimum 5 years of experience in the field or a related area.
• Proven problem-solving, analytical and investigative skills, and strong written communication and teamwork.

Required skills

• Security control frameworks: NIST, PCI DSS, GDPR, ISO 27001, NIS2.
• GRC platforms such as RSA Archer, SAP GRC, StandardFusion, ServiceNow or OneTrust.
• Cloud compliance (AWS, Azure, GCP) and the Cloud Controls Matrix (CCM).
• Risk quantification methods such as FAIR.
• Nice to have: Python automation, BCP/DR planning, and knowledge of the EU AI Act, NIST AI RMF and MITRE ATLAS.