Chief Information Security Officer

This role provides senior cybersecurity leadership for Unidad Editorial in Madrid, addressing local business, editorial and digital platform security needs while ensuring alignment with RCS Mediagroup’s cybersecurity governance model, policies and strategic priorities. REPORTING LINE: Direct reporting:
• Chief Information Officer (CIO), Unidad Editorial Functional reporting:
• Chief Information Security Officer (Group CISO), RCS Mediagroup The role operates within RCS Mediagroup’s cybersecurity governance model and ensures Unidad Editorial’s information security program aligns with Group strategy, policies, standards and controls. ROLE PURPOSE: The Chief Information Security Officer (CISO) is responsible for protecting Unidad Editorial's information assets, digital platforms, editorial systems, cloud environments and technology infrastructure. The position serves as the primary cybersecurity leader for Unidad Editorial, ensuring compliance with RCS Mediagroup's security framework while balancing local business requirements and operational needs. The role acts as the key liaison between Unidad Editorial and the Group Cyber Security function.

KEY RESPONSIBILITIES
Cybersecurity Governance, Coordination and Compliance
• Implement and maintain Unidad Editorial’s information security framework in line with RCS Mediagroup’s cybersecurity strategy, policies, standards and controls.
• Act as the primary liaison between Unidad Editorial and the Group Cyber Security organization, participating in Group security committees, governance forums and strategic initiatives.
• Define and maintain the local cybersecurity roadmap, annual security plan, priorities, budgets, investment proposals, KPIs and risk indicators in coordination with the CIO.
• Report cybersecurity posture, risks, incidents, remediation, audit findings and compliance status to local and Group management.
• Escalate significant cybersecurity risks, incidents, audit findings and compliance issues to the appropriate local and Group stakeholders.
• Support internal and external audits, regulatory compliance activities and collaboration with Legal, Compliance, Privacy and Internal Audit functions. Cyber Risk Management
• Lead cybersecurity risk assessment activities across business and technology environments.
• Maintain the local cyber risk register and monitor remediation plans.
• Assess risks associated with new business initiatives, digital platforms and technology projects.
• Report major cyber risks and mitigation actions to local and Group management. Security Operations
• Oversee security monitoring, incident response and threat detection activities, ensuring alignment with Group procedures and escalation requirements.
• Coordinate effectively with Security Operations Center (SOC) services and Group security teams to ensure consistent monitoring, response and remediation practices.
• Provide oversight of vulnerability management, patch management and penetration testing activities, ensuring remediation priorities are risk-based and tracked to completion.
• Ensure cybersecurity incidents are managed according to Group procedures and escalation processes.
• Contribute to cyber crisis management and business recovery activities by ensuring cybersecurity considerations are integrated into resilience planning. Digital and Editorial Platform Security
• Ensure Security by Design principles are applied across technology and digital initiatives.
• Participate in security reviews of applications, infrastructure and cloud architecture.
• Protect editorial platforms, content management systems, websites, mobile applications and digital products.
• Support digital transformation initiatives with appropriate cybersecurity controls. Third-Party Security
• Oversee security assessments of vendors, suppliers and strategic partners.
• Drive cybersecurity due diligence activities for relevant technology suppliers, outsourced services and strategic partners.
• Ensure third parties comply with contractual and Group cybersecurity requirements.
• Monitor and escalate outsourced-service cybersecurity risks, ensuring clear ownership and remediation follow-up. Security Awareness
• Define and oversee the local security awareness program, ensuring alignment with Group priorities and local risk exposure.
• Ensure cybersecurity training and phishing simulation campaigns are delivered effectively and targeted to relevant user groups.
• Promote a strong security culture across the organization.
• Measure and report awareness program effectiveness. QUALIFICATIONS and

EXPERIENCE:
Education
• Bachelor’s degree in Computer Science, Information Technology, Telecommunications Engineering or equivalent.
• Master’s degree in Cybersecurity, Information Security, Risk Management or equivalent is considered a strong advantage. Professional Experience
• Minimum 5 years of experience in Information Technology, Information Security or cybersecurity.
• At least 2 years of experience in management or leadership positions.
• Experience managing cybersecurity programs within medium-to-large international organizations.
• Proven track record in cyber risk management, incident response and security governance.
• Experience supporting digital businesses, media organizations, publishing companies, telecommunications providers or online service environments is considered a strong advantage. TECHNICAL COMPETENCIES: Essential Competencies
• Strong command of cybersecurity governance, cyber risk management, security program management and third-party risk management.
• Practical knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, GDPR and relevant cyber regulatory requirements.
• Experience overseeing security operations, SOC services, incident response, vulnerability management, security monitoring and threat intelligence activities.
• Solid understanding of infrastructure, network, identity, privileged access, Microsoft 365, cloud and application security controls.
• Ability to translate technical risks into executive-level priorities, remediation plans, KPIs and management reporting. Preferred Capabilities
• Familiarity with advanced security platforms such as SIEM, SOAR, EDR, NDR, CNAPP, WAF and related monitoring or protection technologies.
• Knowledge of business continuity, disaster recovery and cyber resilience practices.
• Knowledge of the NIS2 Directive and its implications for cybersecurity governance, risk management and incident reporting is considered an advantage. LANGUAGE

REQUIREMENTS:
Mandatory
• Native or fluent Spanish
• Professional proficiency in English Preferred
• Italian PERSONAL

SKILLS:
• Strong leadership and stakeholder management capabilities.
• Ability to operate effectively within a matrix and international organization.
• Excellent communication and presentation skills.
• Strong business and risk-oriented mindset.
• Ability to influence decision-making at executive level.
• Strong collaboration and relationship-building skills across cultures and functions.
• Ability to manage priorities and make decisions in complex environments. CERTIFICACTIONS (considered as an advantage)
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CRISC (Certified in Risk and Information Systems Control)
• CCSP (Certified Cloud Security Professional)
• ISO/IEC 27001 Lead Auditor/Implementer IDEAL CANDIDATE PROFILE: The ideal candidate is a senior cybersecurity leader able to operate at the intersection of business, technology, risk and Group governance. The candidate will act as the trusted cybersecurity reference point for Unidad Editorial, ensuring that local priorities are effectively addressed while maintaining full alignment with RCS Mediagroup's cybersecurity strategy, policies, standards and control framework. The successful candidate will combine executive credibility, practical security judgment and strong stakeholder management skills, translating cyber risks into business decisions, guiding remediation priorities, supporting secure digital innovation and representing Unidad Editorial in local and Group-level governance forums.