Technical Governance Risk & Compliance Specialist

Job description

Ebury helps ambitious businesses unlock global growth, and we take the same approach with our people. We encourage innovation and movement, collaboration and problem-solving, and foster an environment where everyone can feel they belong, are valued, supported and empowered to succeed. If you’re a collaborator who wants to help transform how businesses operate globally, get in touch - we’d love to discuss how Ebury can accelerate your career so you can shape the future. Technology GRC Lead • Location: Madrid or London Role Overview Technology is accountable to Internal Audit, Compliance, and Risk for how it manages technology risk and meets its regulatory obligations. This role directly owns that accountability. You will lead the Technology GRC programme, maintaining Tech’s overall compliance posture, providing a centralised view of risks, controls, and audit findings, and integrating GRC priorities directly into the core Technology roadmap. Reporting to the Head of Security Engineering, you will serve as the primary liaison between Technology and internal/external oversight bodies (Internal Audit, Compliance, IT Risk), representing the department at executive risk committees. Key Responsibilities Technology GRC Programme Management • Own the Programme: Drive Technology’s compliance posture and establish a single source of truth for technology risk and compliance metrics. • Centralise Requests: Manage and triage incoming audit, risk, and compliance inquiries across Technology and Engineering, setting coordinated response strategies and holding stakeholders accountable. • Maintain Risk Registers: Administer the Technology risk register in AuditBoard, ensuring risk ratings, control mappings, and action plans are actively maintained and agreed upon by risk owners. • Governance & Reporting: Represent Technology at risk committees, delivering data-driven reporting on KPIs, risk positions, and remediation progress. Audit, Assurance & Control Frameworks • Audit Execution: Lead internal and external audits end-to-end—from initial scoping and evidence coordination to remediation and closure. • Remediation Tracking: Enforce agreed remediation timelines across engineering teams, escalating proactively to senior leadership when target dates slip. • Control Design: Align and define the Technology control framework against industry standards (ISO 27001, NIST, CIS) and applicable regulatory mandates. • Policy Governance: Author, update, and manage the approval lifecycle for Technology policies, standards, and standard operating procedures (SOPs). Engineering Integration & Automation <ul data-path-to-node=&qu