10/05/2026 updated
MH
100 % available
Senior IT Governance | Cybersecurity | GRC Executive | CISO | DORA & NIS2 Program Lead
madrid, Spain
Only remote
Degree in Biochemistry, CISM, CDPSE, ISO 27001. ISO 20000, PCIDSSAbout me
External cybersecurity advisor and vCISO helping organizations turn security, regulatory and resilience requirements into practical governance. Expertise in GRC, ISO 27001, risk management, internal audit, operational resilience, third-party risk, DORA, NIS2 and security training.
Certified in the Governance of Enterprise ITCorporate GovernanceData GovernanceGovernance Risk Management and ComplianceInformation GovernanceIT ManagementSecurity Managing
Cybersecurity Governance & GRC
Expertise in cybersecurity governance, GRC frameworks, security strategy, security policies and procedures, and enterprise risk management across highly regulated environments with 25+ years of experience.
Regulatory Compliance & Framework Implementation
Hands-on experience implementing ISO 27001, ISO 27002, ISO 20000, ISO 27017, ISO 22301, ENS, NIS2, DORA, GDPR, PCI-P, EBA, SOC and IEC 62443, with 19+ ISO 27001 / ISO 20000 / NIS2 / DORA implementations and 12 ENS implementation projects.
Third-Party Risk Management & Audit Readiness
Extensive experience in third-party risk management, critical supplier audits, continuous assurance, internal audits, certification support and audit readiness, with 100+ critical suppliers audited and 100% certification pass rates reported.
IT/OT Governance
Governance of both IT and OT environments, including security metrics, KPIs and executive stakeholder management.
Business Continuity & Crisis Management
Planning and management of business continuity and crisis management programs within complex organizational structures.
GDPR & Data Protection
GAP analysis, risk analysis of processing activities, DPIAs / EIPD, records and protocols, and DPO implementation across multiple organizations including public administrations.
Security Awareness & Training
Design and delivery of 30+ security awareness sessions and ISO 27001 / ENS training for 8 organizations, training 500+ employees and achieving a reported 40% reduction in phishing susceptibility.
SAP GRC & Logical/Physical Access Control
Experience with SAP GRC, PKI, logical access control and physical access control within enterprise security environments.
Security Tools & Platforms
Practical knowledge of tools including GlobalSuite, PILAR, Sandas GRC, SAP GRC and related security management platforms.
Expertise in cybersecurity governance, GRC frameworks, security strategy, security policies and procedures, and enterprise risk management across highly regulated environments with 25+ years of experience.
Regulatory Compliance & Framework Implementation
Hands-on experience implementing ISO 27001, ISO 27002, ISO 20000, ISO 27017, ISO 22301, ENS, NIS2, DORA, GDPR, PCI-P, EBA, SOC and IEC 62443, with 19+ ISO 27001 / ISO 20000 / NIS2 / DORA implementations and 12 ENS implementation projects.
Third-Party Risk Management & Audit Readiness
Extensive experience in third-party risk management, critical supplier audits, continuous assurance, internal audits, certification support and audit readiness, with 100+ critical suppliers audited and 100% certification pass rates reported.
IT/OT Governance
Governance of both IT and OT environments, including security metrics, KPIs and executive stakeholder management.
Business Continuity & Crisis Management
Planning and management of business continuity and crisis management programs within complex organizational structures.
GDPR & Data Protection
GAP analysis, risk analysis of processing activities, DPIAs / EIPD, records and protocols, and DPO implementation across multiple organizations including public administrations.
Security Awareness & Training
Design and delivery of 30+ security awareness sessions and ISO 27001 / ENS training for 8 organizations, training 500+ employees and achieving a reported 40% reduction in phishing susceptibility.
SAP GRC & Logical/Physical Access Control
Experience with SAP GRC, PKI, logical access control and physical access control within enterprise security environments.
Security Tools & Platforms
Practical knowledge of tools including GlobalSuite, PILAR, Sandas GRC, SAP GRC and related security management platforms.
Experience
Professional experience10+ years
Freelancer since2025
Languages
EnglishFluentSpanishNative speaker
Project history
Advisory leadership in resilience, regulatory technology risk and DORA program delivery.
Technical leadership, security advisory, delivery management and governance initiatives.
Security governance leadership and development of audit-ready security management capabilities.