> Markdown version of [/jobs/ext/2901481-grc-program-manager](https://www.wearedevelopers.com/jobs/ext/2901481-grc-program-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Grc Program Manager

- **Company:** AILY LABS
- **Location:** Barcelona, Spain
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cyber Security
- **Published:** September 14, 2026
- **Apply:** https://www.buscojobs.com.es/grc-program-manager-en-barcelona-ID-371761141

## About the Role

Experience: 4+ years in GRC, compliance, security operations, or audit roles, with demonstrated experience owning at least one compliance framework or security operations program end-to-end (scoping, control design, audit coordination, certification).

## Description

MissionWe're seeking a GRC Program Manager to own a defined set of compliance, risk, and security operations frameworks end-to-end.You won't spend your time on routine evidence collection or manual audit checklists-we automate that. Instead, you'll own the complexity: the stakeholder coordination, the conceptual design of how frameworks apply to our environment, and the human judgment calls that automation can't make. Your scope extends beyond traditional GRC into the program and organizational aspects of Security Operations-ensuring detection, response, and operational processes are governed, measured, and continuously improved. Success means your frameworks run smoothly, auditors get what they need without chasing people, and control owners across the business understand what's expected of them-because you designed it that way.As a GRC Program Manager, you are the reference person for your assigned frameworks-spanning compliance, risk, and security operations. You own them from interpretation through implementation-designing how controls map to our systems, coordinating across teams to ensure accountability, and managing external auditor relationships. You also own the programmatic and organizational side of Security Operations: how we structure detection and response processes, measure operational effectiveness, and ensure continuous improvement.Routine operational work is handled through AI and automation;your value is in the complexitythat requires human judgment.Framework Ownership & Coordination:Own assigned compliance frameworks (e.G., SOC 2, ISO *****, GDPR, AI regulations) endto-end-from interpreting requirements and designing control mappings to ensuring audit readinessAct as the single point of accountability for your frameworks: auditors, control owners, and leadership come to you for answersCoordinate cross-functional stakeholders (Engineering, Product, Legal, People) to ensure controls are embedded in their workflows-not bolted on as afterthoughtsManage external auditor relationships, including scoping discussions, audit planning, finding resolution, and certification deliveryAnticipate how regulatory changes affect your frameworks and proactively adapt the control environmentOwn the program structure of Security Operations-defining how detection and incident response processes are organized, governed, and reported onConceptual Design & Judgment:Design how abstract regulatory requirements translate into concrete, testable controls for our specific technology stack and business modelMake judgment calls on control applicability, risk acceptance recommendations, and framework interpretation where guidance is ambiguousDefine the conceptual structure of vendor assessments for your domain-what matters, what doesn't, and where to draw the lineDesign and maintain the organizational framework for security operations-playbook governance, escalation structures, SLA definitions, and operational metricsAuthor and maintain policies that are enforceable and aligned to how the business actually operates-not compliance theaterStakeholder Enablement & Human Coordination:Enable control owners to be self-sufficient: design clear expectations, provide context on why controls exist, and remove friction from their compliance responsibilitiesCoordinate remediation across teams when gaps are identified-driving accountability without micromanaging executionCommunicate compliance posture and framework status to leadership in business termsResolve ambiguity and competing priorities between business velocity and compliance obligations-finding paths that serve bothAI & Automation Leverage:Design and maintain automated evidence collection, monitoring, and reporting workflow so routine compliance work runs without manual interventionContinuously identify where human effort in your programs can be replaced by automation, AI-assisted review, or platform configurationUse AI tools as a force multiplier for research, gap analysis, policy drafting, and audit preparation-the expectation is that you operate at a level only possible with these toolsYour profileExperience: 4+ years in GRC, compliance, security operations, or audit roles, with demonstrated experience owning at least one compliance framework or security operations program end-to-end (scoping, control design, audit coordination, certification).


## Related Videos

- [Edit Your Future: Queerverse Radical AI](https://www.wearedevelopers.com/videos/909-edit-your-future-queerverse-radical-ai)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Hack Me If You Can: Designing Unbreakable LLM Guardrails](https://www.wearedevelopers.com/videos/100209-hack-me-if-you-can-designing-unbreakable-llm-guardrails)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)
- [How to Stop Your Agents From Going Rogue - Arnav Gupta](https://www.wearedevelopers.com/videos/2152-how-to-stop-your-agents-from-going-rogue-arnav-gupta)
- [AI is dead, long live AK](https://www.wearedevelopers.com/videos/1093-ai-is-dead-long-live-ak)

## Related Articles

- [Everything a Developer Needs to Know About MCP with Neo4j](https://www.wearedevelopers.com/magazine/604-everything-a-developer-needs-to-know-about-mcp-with-neo4j)
- [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)
- [Dev Digest 132 - Binging WADFlix?](https://www.wearedevelopers.com/magazine/473-dev-digest-132-binging-wadflix)
- [What is Agentic Programming and Why Should Developers Care?](https://www.wearedevelopers.com/magazine/625-what-is-agentic-programming-and-why-should-developers-care)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)