About the job:
We are looking for an Information & Blockchain Security Specialist to join BBVA, combining responsibilities across Information Security and the oversight and change management of our crypto custody service.
This is a role at the intersection of cybersecurity, cloud technology and digital assets. The successful candidate will work closely within the Security & Technology team and will contribute to ensuring that our technology and crypto custody environments operate securely, reliably and in line with BBVA's security standards.
The role does not require deep blockchain development expertise. However, candidates should understand how public blockchain networks operate, particularly Bitcoin and Ethereum, and be comfortable working with technical teams and third-party service providers in a regulated financial-services environment.
Functions (duties and responsibilities):- Support the implementation, operation and continuous improvement of information security controls, with particular focus on cloud environments.
- Contribute to the security oversight of Microsoft Azure services and architectures.
- Support activities related to information protection, data security and cryptographic controls.
- Assess security requirements and risks associated with new solutions, services and technology changes.
- Participate in security reviews and contribute to the definition and monitoring of remediation actions.
- Work with technology, security and business stakeholders to ensure appropriate security controls throughout the service lifecycle.
- Contribute to the management of security risks associated with external and third-party technology providers.
- Support the technical and security oversight of BBVA's Crypto Custody service.
- Coordinate and supervise changes affecting the Crypto Custody platform and service, including assessment of their security and operational implications.
- Act as a technical counterpart to the third-party provider responsible for the custody technology, challenging and validating proposed changes when appropriate.
- Understand and assess the impact of changes to the blockchain protocols and networks supported by the service, with particular focus on Bitcoin and Ethereum.
- Participate in the analysis of incidents, vulnerabilities, protocol changes and other technical events that may affect the custody service.
- Support the assessment and monitoring of security controls associated with crypto-asset custody, including areas such as key management, cryptography, transaction security, access management and operational resilience.
- Facilitate coordination between Security, Technology teams, external providers and other stakeholders involved in the Crypto Custody service.
- Document Policies, Norms, and Procedures and participate in the definition on the procedures associated with physical and technological security.
Your profile:Required experience and knowledge- Professional experience in Information Security, Cybersecurity, Technology Risk or a related technical field.
- Good understanding of security principles and controls in cloud environments, preferably Microsoft Azure.
- Knowledge of information protection, encryption, cryptography, identity/access controls and data security.
- Understanding of blockchain fundamentals and how decentralized blockchain networks operate.
- Knowledge of Bitcoin and Ethereum, including concepts such as transactions, addresses, wallets, private/public keys, digital signatures, network validation and transaction finality.
- Ability to understand technical architectures and evaluate security implications without necessarily being a software developer.
- Experience working with third-party technology providers, including technical oversight, change management, risk assessment or service management.
- Ability to communicate effectively with both technical and non-technical stakeholders.
- Professional working proficiency in English.
Nice to have- Hands-on experience with Microsoft Azure security services and controls.
- Experience with Microsoft Purview, Key Vault, HSMs, key management, or other information-protection technologies.
- Knowledge of cryptographic key lifecycle management, post-quantum cryptography and secure key custody.
- Previous exposure to digital assets, crypto custody, blockchain infrastructure or financial-market technology.
- Understanding of security considerations associated with wallets, signing processes, blockchain transactions and digital-asset custody models.
- Experience in banking, financial services or another highly regulated environment.
- Familiarity with cybersecurity and technology-risk frameworks and regulatory requirements applicable to financial institutions.
- Knowledge of quantum computing effects and cryptography related issues, is a plus.
- Relevant security or cloud certifications would be an advantage.
We are looking for someone with a security-first mindset who is also curious about emerging technologies.
You do not need to be a blockchain developer or a crypto specialist. You should, however, be able to understand how Bitcoin and Ethereum work at a technical level, identify the security implications of changes to these technologies, and engage confidently with specialists and external providers.
The ideal candidate combines information security expertise, technical judgement and strong stakeholder-management skills, and is comfortable operating at the intersection of traditional banking technology and digital assets.
Skills:
Bitcoin, Blockchain, Change Management, Cloud Security, Cryptography, English Language, Ethereum (ETH), Information Protection, Information Security, Key Management, Microsoft Azure, Team Collaboration, Team Player, Technology Risk, Third Party Risk Management
