GRC Engineer

Tractian; São Paulo; Sur place; BRL 120 000 - 260 000; Plein temps

Avantages offerts par ce poste

30 days leave

Education stipend

Meals allowance

Health plan

Dental Insurance

Wellhub membership

Résumé du poste

Tractian is seeking a GRC Engineer to join its Governance, Risk, and Compliance team in São Paulo. You will develop and enhance security governance, risk management, and compliance programs, collaborating with Engineering and business units to strengthen controls and support audits.

You will leverage AI and automation to optimize GRC workflows, participate in SOC 2, ISO 27001/27002 alignment, and drive continuous improvement across BCM, DR, IR, and TPRM domains.

Qualifications

• Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or related fields.
• Proven hands-on experience implementing or improving information security governance, risk management, and compliance programs.
• Experience with ISO 27001 / ISO 27002, SOC 2, or equivalent security frameworks.
• Proven hands-on experience in Information Security Risk Management, including risk assessments, risk treatment, control evaluation, and remediation management.
• Practical experience implementing BCM and DR processes, including BIA, RTO/RPO, recovery planning, and testing.
• Hands-on experience with IR processes, including incident management, response procedures, exercises, and post-incident improvement.
• Experience conducting TPRM assessments, evaluating vendor security controls, and managing risks.
• Knowledge of LGPD and GDPR data protection requirements.
• Understanding of SDLC security controls, code review, vulnerability management.
• Understanding of cloud concepts, IAM, and cybersecurity concepts.
• Experience supporting audits, assessments, and evidence management.
• Ability to assess risks and drive improvements across GRC domains.
• Ability to leverage AI and automation to improve workflows.
• Advanced Portuguese and English proficiency.

Responsabilités

• Develop, implement, and continuously improve information security governance, risk management, compliance, and assurance processes.
• Support compliance with frameworks and standards such as ISO 27001, ISO 27002, SOC 2, and other applicable requirements.
• Conduct risk assessments, evaluate security controls, maintain risk registers, and coordinate risk treatment and remediation activities.
• Support internal and external audits, certification processes, evidence collection, and continuous compliance monitoring.
• Develop and maintain security policies, standards, procedures, and governance documentation.
• Improve BCM, DR, IR, and TPRM activities, including gap analysis, planning, exercises, and testing.
• Assess secure software development practices and collaborate with Engineering to integrate security into SDLC.
• Conduct customer security and compliance due diligence, including security questionnaires, RFPs, and contractual assessments.
• Identify and implement opportunities to automate GRC processes using AI, APIs, integrations, and other technologies.
• Collaborate with Engineering, Infrastructure, Security, Product, and business teams to integrate security and compliance requirements into processes.

Connaissances

Information Security

GRC

Risk Management

Internal Audit

Compliance

Portuguese

English

Vanta

Drata

Outils

Vanta

Drata

Description du poste

GRC Engineer

As a GRC Engineer, you will be part of our Governance, Risk, and Compliance (GRC) team, contributing to the development, implementation, and continuous improvement of our security governance, risk management, and compliance programs. You will collaborate with technical and business teams to strengthen security controls, manage risks, and support compliance with industry standards. We are looking for an experienced, hands‑on, and versatile professional with strong GRC expertise and a technical mindset. You will work alongside the team to drive initiatives across multiple GRC domains, leveraging Artificial Intelligence (AI), automation, and emerging technologies to build scalable and efficient processes.

Key Responsibilities

• Develop, implement, and continuously improve information security governance, risk management, compliance, and assurance processes.
• Support compliance with frameworks and standards such as ISO 27001, ISO 27002, SOC 2, and other applicable requirements.
• Conduct risk assessments, evaluate security controls, maintain risk registers, and coordinate risk treatment and remediation activities.
• Support internal and external audits, certification processes, evidence collection, and continuous compliance monitoring.
• Develop and maintain security policies, standards, procedures, and governance documentation.
• Improve Business Continuity Management (BCM), Disaster Recovery (DR), Incident Response (IR), and Third-Party Risk Management (TPRM) activities, including gap analysis, planning, exercises, and testing.
• Assess secure software development practices and collaborate with Engineering teams to integrate security and compliance requirements into the Software Development Lifecycle (SDLC).
• Conduct customer security and compliance due diligence, including security questionnaires, RFPs, and contractual security assessments.
• Identify and implement opportunities to automate GRC processes using AI, APIs, integrations, and other technologies.
• Collaborate with Engineering, Infrastructure, Security, Product, and business teams to integrate security and compliance requirements into operational and technical processes.

Requirements

• Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or related fields.
• Proven hands‑on experience implementing or improving information security governance, risk management, and compliance programs.
• Experience with ISO 27001 / ISO 27002, SOC 2, or equivalent security frameworks.
• Proven hands‑on experience in Information Security Risk Management, including risk assessments, risk treatment, control evaluation, and remediation management.
• Practical experience implementing or maintaining Business Continuity Management (BCM) and Disaster Recovery (DR) processes, including BIA, RTO/RPO, recovery planning, and testing.
• Hands‑on experience with Incident Response (IR) processes, including incident management, response procedures, exercises, and post‑incident improvement.
• Experience conducting Third‑Party Risk Management (TPRM) assessments, evaluating vendor security controls, and managing associated risks.
• Knowledge of data protection and privacy requirements, including LGPD and GDPR.
• Understanding of assessing Secure Software Development practices, including SDLC security controls, code review processes, vulnerability management, etc.
• Understanding of cloud infrastructure concepts, identity and access management, and cybersecurity concepts.
• Experience supporting internal or external audits, compliance assessments, and evidence management.
• Ability to independently assess risks, evaluate controls, and drive improvements across different GRC domains.
• Ability to leverage AI, automation tools to improve workflows, solve problems, and increase operational efficiency.
• Advanced Portuguese and English proficiency.

Nice to Have

• Experience with GRC platforms (e.g., Vanta, Drata).
• Experience with Policy‑as‑Code or Compliance‑as‑Code
• Familiarity with cloud environments (AWS, OCI, GCP), Infrastructure as Code (IaC), CI/CD pipelines, and Git‑based workflows.
• Experience building AI‑assisted workflows or using LLMs and AI agents to automate GRC activities.
• Knowledge of additional frameworks such as ISO 22301, ISO 27701, ISO 42001, NIST CSF, or FedRAMP.
• Market‑recognized security, risk management, or compliance certifications.

Compensation & Benefits

• Competitive Compensation
• 30 days of paid annual leave
• Education and courses stipend
• Earn a trip anywhere in the world every 4 years
• R$1.035/month for meals allowance
• Health plan with national coverage and without coparticipation
• Dental Insurance: we help you with dental treatment for a better quality of life.
• Wellhub Membership: Access a wide range of gyms and training programs.