Security GRC Engineer

Glovo is part of the Delivery Hero Group, the world's pioneering local delivery platform. We operate in around 65 countries worldwide. Headquartered in Berlin, Germany.

• Develop, implement, and maintain security policies and procedures in line with relevant compliance frameworks (e.g., ISO 27001, NIST, PCI DSS, GDPR, NIS2, EU AI Act).
• Develop, execute and deliver security awareness programs to educate employees on best practices and compliance requirements.
• Conduct security assessment risks, recommending and implementing mitigation strategies, maintaining a risk register and monitoring the status of remediation plans.
• Coordinate and respond to customer security inquiries and due diligence questionnaires (e.g., SIG, CAIQ). Review and provide input on contract modifications related to security, data protection, and privacy.
• Propose, develop and implement processes and tools for continuous monitoring of security monitoring to ensure ongoing adherence to policies.
• Assist with the end-to-end security certification and re-certification process (such as PCI DSS, ISO 27001, NIS2, among others).
• Assist with internal assessments to identify gaps, weaknesses, or non-compliance issues within our security controls.
• Support external and internal audits by preparing documentation and coordinating with auditors, follow ups and findings remediation.
• Serve as a key liaison between technical teams, legal, internal audit, and business units to ensure a unified approach to security and compliance.

• BA/BS in Computer Science, Information Systems, or similar field.
• Professional security certifications (CISSP, CISM, CISA, ISO 27001 Lead Implementer or equivalent).
• Minimum 5 years of experience in the field or in a related area.
• Solid understanding and previous experience of security control frameworks (NIST, PCI DSS, GDPR, ISO 27001, NIS2).
• Hands-on experience with GRC platforms (e.g. RSA Archer, SAP GRC, StandardFusion, ServiceNow, OneTrust, etc).
• Strong ability to manage and report on multiple projects, prioritizing efforts, managing time effectively, and requiring minimal direction in the execution.
• Proven problem solving, analytical and investigative skills combined with the ability to develop creative solutions and navigate through ambiguity in a fast-paced, agile environment.
• Proven team player, collaborating well with others to tackle problems in a team-focused dynamic.
• Excellent written and communications skills, as well as strong interpersonal and relationship building skills.
• Experience with compliance in cloud environments (AWS, Azure, GCP) and knowledge of frameworks like the Cloud Controls Matrix (CCM).
• Experience in risk quantification methodologies (e.g., FAIR) to assess financial and operational impact of security risks.
• Strong background in designing and delivering effective security awareness programs to foster a security-first culture.

• Development skills.