Opportunity at
EburySenior Security Engineer (L4) - GRC
Ebury is looking for a Senior Security Engineer to manage technology GRC operations. Founded in 2009, Ebury is a financial technology company that provides international businesses…
Career Tools
About This Role
Ebury is looking for a Senior Security Engineer to manage technology GRC operations. Founded in 2009, Ebury is a financial technology company that provides international businesses with financial accounts, risk management, and financing tools via a single integrated platform. The organization employs over 2000 personnel across nearly 70 cities. In this capacity, you will oversee the technology governance, risk, and compliance program, maintain overall security compliance standards, and serve as…
Job Description
Ebury is looking for a Senior Security Engineer to manage technology GRC operations. Founded in 2009, Ebury is a financial technology company that provides international businesses with financial accounts, risk management, and financing tools via a single integrated platform. The organization employs over 2000 personnel across nearly 70 cities.
In this capacity, you will oversee the technology governance, risk, and compliance program, maintain overall security compliance standards, and serve as the main point of contact between the technology division and external or internal audit groups. The role involves managing risk registers, leading audits, tracking remediation efforts, designing control structures, and working alongside engineering personnel to integrate compliance into development pipelines. You will also conduct vendor risk evaluations and deliver executive-level reporting on key risk indicators.
Responsibilities
- Manage and direct the technology GRC program to establish a single source of truth for compliance and risk metrics
- Triage and coordinate audit, risk, and compliance inquiries across technology and engineering groups
- Maintain the technology risk register in AuditBoard, ensuring accurate risk ratings, control mappings, and action plans
- Represent the technology department at risk committees by reporting on KPIs, risk posture, and remediation progress
- Lead internal and external audits from initial scoping and evidence collection through to closure
- Enforce remediation timelines across engineering teams and escalate delays to senior leadership
- Define and align technology controls with frameworks like ISO 27001, NIST, and CIS
- Author, update, and manage technology policies, standards, and standard operating procedures
- Translate regulatory deadlines and risk findings into engineering product and backlog deliverables
- Partner with technology directors to prioritize compliance tasks alongside feature work
- Collaborate with engineering teams to build automated control validation and continuous evidence collection
- Perform security and risk evaluations for technology vendors, software providers, and SaaS tools
Requirements
- Minimum of 3 years of professional experience in IT or cybersecurity GRC, IT risk, or IT auditing, preferably within regulated environments such as fintech or financial services
- Demonstrated ability to independently lead technology audits and risk programs
- Working knowledge of ISO 27001, NIST, CIS, and IT General Controls covering change management, access management, and operations
- Technical familiarity with cloud infrastructures including AWS, GCP, and Azure, alongside IAM, CI/CD pipelines, and secure SDLC
- Demonstrated experience presenting risk dashboards and metrics to executive leadership and risk committees
- Strong communication skills in English to bridge discussions between technical engineers and non-technical auditors
Qualifications
- Hands-on experience administering modern GRC platforms such as AuditBoard
- Familiarity with frameworks and regulations including SOC 2 Type II, PCI DSS, or DORA
- Prior experience setting up automated compliance monitoring or evidence pipelines
- Industry certifications such as CISA, CRISC, CISM, or ISO 27001 Lead Auditor
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the location of this role?
The job posting lists the location as London.
What is the remote work policy?
The source posting does not specify a remote work policy for this particular role.
What experience is required to apply?
Applicants must have at least 3 years of experience in IT or cybersecurity GRC, IT risk, or IT audit, ideally within a regulated environment.
What is the salary for this position?
The salary is not stated in the job posting.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
