GRC Information Security Engineer | Fintech Compliance

ARQ; Bogotá; On-site; COP 221,498,000 - 348,068,000; Full time

Benefits offered by this job

Stock options

Discretionary performance bonus

Latest tools and technology

World-class team

Job summary

ARQ is seeking an experienced GRC professional based in Colombia to shape security governance, risk, and compliance across the group. You will work with the CISO and a global security team to own programmes enabling growth in multiple markets.

You will turn framework requirements into practical controls, collaborate with engineers to close gaps, and provide auditors and regulators with a clear view of risk management. You will also help automate repetitive GRC tasks with oversight.

Qualifications

• 5+ years in information security GRC, IT audit or cyber risk, including 2+ years in financial services.
• Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, with PCI DSS knowledge.
• Practical GDPR understanding: lawful basis, DPA, international transfers and breach notification.
• Experience running vendor security reviews and interpreting SOC 2 reports with exc. and relevant UC controls.
• Clear policy/procedure writing translating control requirements into actions for engineers.
• Ability to work with auditors/regulators and close findings.
• Spanish fluency for regulator discussions; professional English for global team collaboration.
• Autonomy to manage priorities across countries/time zones; based in Colombia (Bogotá preferred).

Responsibilities

• Own and improve security compliance programmes, incl. SOC 2, PCI DSS readiness and GDPR requirements.
• Coordinate audit preparation: define scope, manage evidence, drive remediation.
• Own vendor security due diligence from initial risk assessment to ongoing monitoring.
• Lead responses to security questionnaires, partner audits and regulatory requests with stakeholders.
• Keep security risk register, policies and procedures current with actionable remediation plans.
• Own privacy work across the group on data processing agreements and international transfers.
• Translate security/compliance obligations into concrete engineering/business tasks.
• Help build automated workflows and AI-assisted processes to reduce repetitive GRC work with oversight.

Skills

GRC

SOC 2

ISO 27001

PCI DSS

GDPR

Policy writing

Audits & regs

Regulatory coordination

Spanish fluency

English communication

Tools

GRC platforms—OneTrust

GRC platforms—Drata

GRC platforms—Vanta

Job description

ARQ is seeking an experienced GRC professional based in Colombia to shape security governance, risk, and compliance across the group. You will work with the CISO and a global security team to own programmes enabling growth in multiple markets.

You will turn framework requirements into practical controls, collaborate with engineers to close gaps, and provide auditors and regulators with a clear view of risk management. You will also help automate repetitive GRC tasks with oversight.