Information Security Director, Spain
This is the employer's own posting, not a copy on a job board.
What we know
Is it still open?
Confirmed still open
Last checked 1d ago — checked against the employer's own applicant tracking system, which is the company answering directly.
We re-read the employer's own applicant tracking system and the posting was still there. That is the company answering directly.
How old is it?
Posted 150d ago
The date the source published, not the day we noticed it (2026-05-14). Last seen at its source 2h ago.
We have tracked this listing since 9 Oct 2026 (1 days). The employer's own board has carried it every time we have read it, most recently 2 hours ago.
Is it remote?
Marked remote on the employer's board
Their board carries a remote setting on this posting — a field they filled in, not wording we read. The location field names somewhere specific, which is usually where the team or the entity sits.
Who may apply?
Spain
The description states no restriction of its own. This is the source's own tag.
Skills named in the ad
Recognised terms only, from a fixed vocabulary — this is what CV matching compares against.
Carried by 1 source
-
BambooHR employer's own board first seen 1d ago · last seen 2h ago
The listing
CEX.IO Europe S.L. is in the final stages of obtaining authorization under the EU Markets in Crypto-Assets Regulation (MiCA) as a Crypto-Asset Service Provider (CASP) in Spain. As part of our regulatory readiness and local substance requirements, we are actively recruiting a Spain‑based Information Security Director.
The Information Security Director will be the primary local official responsible for ensuring the digital operational resilience of CEX.IO Europe S.L. in accordance with Regulation (EU) 2022/2554 (DORA).
The Information Security Director’s core mandate is to maintain an effective local capacity for decision-making, supervision, and questioning over all ICT functions delegated to group entity service providers. This includes the explicit authority to understand, supervise, question, approve, reject, or nullify any technical action, proposal, or recommendation from Group service providers that impacts EU operations.
The Information Security Director is responsible for the independent management of technology and cyber risks within the Spanish jurisdiction, ensuring operational substance and digital resilience. The Information Security Director acts as the principal technical liaison and accountable officer for the National Securities Market Commission (CNMV) and the Bank of Spain on all cybersecurity, DORA compliance, and DLT-related supervisory matters.
Key Responsibilities
- DORA & MiCA Governance: Lead the implementation and maintenance of the ICT risk management framework to meet CNMV, ESMA, and EBA standards.
- Oversight of Delegated Functions: Supervise and control ICT services provided by CEX.IO group entities (including CEX.IO Ltd, UK), spanning cloud infrastructure, software development, and security operations.
- ICT Risk Management: Identify, assess, and mitigate technological risks. Conduct annual reviews of the Business Impact Analysis (BIA) and the ICT Risk Assessment.
- Incident Management: Act as the ultimate local authority for initiating the Incident Response Plan (IRP) for high and critical security events. Coordinate notifications of major ICT-related incidents to the CNMV within mandated regulatory timelines (4h / 72h / 30 days).
- Third-Party ICT Security: Supervise critical ICT third-party service providers, monitoring compliance with contractual SLAs, Recovery Point Objectives (RPOs), and Recovery Time Objectives (RTOs).
- Custody Security & Cryptographic Controls: Oversee the security of crypto-asset custody solutions (proprietary V2/V3 infrastructure and external sub-custodians). Ensure the integrity of Multi-Party Computation (MPC), Hardware Security Modules (HSM), and multisig signing workflows.
- Secure SDLC Oversight: Supervise the Secure Software Development Life Cycle (SDLC) and validate security testing in pre-production (UAT) environments prior to operational deployment.
- Resilience & DLT Testing: Approve and collaborate on operational resilience testing plans, threat-led penetration testing (TLPT), and specific tests covering Distributed Ledger Technology (DLT) protocols.
- Asset & Inventory Governance: Maintain a unified, centralized inventory of all CEX.IO ICT assets, systems, and network infrastructure supporting Spanish and EU operations.
Requirements and Qualifications
- University degree in Computer Science, Computer Engineering, Cybersecurity, or a related technical field, ideally holding relevant industry certifications (e.g., CISM, CISSP, CRISC, or CISA).
- Proven track record in building cybersecurity frameworks and complying with EU financial sector regulations (DORA, MiCA, PCI DSS).
- Technical Domain Knowledge: Vulnerability management, threat monitoring tools, and SIEM/SOC platforms (e.g., Grafana, Kibana, Elastic).
- Cryptographic protocols, key ceremony management, and secure private key storage.
- Strong communication skills for interacting directly with financial regulators (CNMV / Bank of Spain) and leading technical governance under a "hub and spoke" group operational model.
- Full local tax/legal residency in Spain with native/bilingual proficiency in Spanish and professional working proficiency in English.