GRC Consultant

Description

**Description:** ---------------- **Join Ciberia and redefine the future of AI-driven cybersecurity!** At Iris, we do not just create companies—we forge leaders in technological innovation. With this mission, Ciberia was born: the new global benchmark in managed cybersecurity services, backed by Google Cloud Security. As a Google Premier Partner for EMEA and LATAM, we operate across 5 countries, delivering cutting-edge solutions powered by Artificial Intelligence, Cloud, Data, and Cybersecurity—all guided by excellence, transparency, and trust. If you seek an environment where your professional judgment directly impacts strategic projects, this is your place. To continue driving our growth, we are looking for a **GRC Consultant** with a solid foundation in data protection, active experience in security frameworks, and an integrative vision capable of connecting privacy with cybersecurity. **Your main responsibilities:** * Comprehensive LOPDGDD/RGPD Management: Lead full compliance adaptations, maintain the Record of Processing Activities (RAT), draft informative clauses, and manage ARCO rights. * Conduct compliance audits and Data Protection Impact Assessments (DPIAs). * Provide ongoing advisory support to clients and respond to privacy incidents. * Collaborate on implementation and maintenance projects for systems aligned with ISO 27001 and the Spanish National Security Scheme (ENS). * Participate in ISO 22301 projects, supporting the development of Business Impact Analyses (BIAs) and continuity plans. * Conduct internal audits evaluating security and privacy controls jointly. * Draft policies, procedures, and regulations covering both security and privacy requirements. **Requirements:** --------------- * Experience: Minimum 3 years in GRC consulting. You must demonstrate strong expertise in LOPDGDD/RGPD, along with proven participation in ISO 27001 and/or ENS projects. * Regulatory Knowledge: LOPDGDD and RGPD; ISO 27001 (Information Security), ENS (Spanish National Security Scheme), and ISO 22301\. * Ability to understand how a security control (e.g., Access Management) impacts compliance with LOPD. * Location: Residence in Barcelona. ***Preferred (Desirable):*** * Law degree with a master’s in Cybersecurity/ICT, or a technical profile with a master’s in Technological Law. * Certifications: *DPO (Data Protection Officer)*; *ISO 27001 or ISO 22301 Implementer or Lead Auditor*.