Information Security Engineer | GRC

ARQ; Bogotá; Presencial; COP 221.498.000 - 348.068.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Stock options

Discretionary performance bonus

Latest tools and technology

World-class team

Descripción de la vacante

ARQ is seeking an experienced GRC professional based in Colombia to shape security governance, risk, and compliance across the group. You will work with the CISO and a global security team to own programmes enabling growth in multiple markets.

You will turn framework requirements into practical controls, collaborate with engineers to close gaps, and provide auditors and regulators with a clear view of risk management. You will also help automate repetitive GRC tasks with oversight.

Formación

• 5+ years in information security GRC, IT audit or cyber risk, including 2+ years in financial services.
• Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, with PCI DSS knowledge.
• Practical GDPR understanding: lawful basis, DPA, international transfers and breach notification.
• Experience running vendor security reviews and interpreting SOC 2 reports with exc. and relevant UC controls.
• Clear policy/procedure writing translating control requirements into actions for engineers.
• Ability to work with auditors/regulators and close findings.
• Spanish fluency for regulator discussions; professional English for global team collaboration.
• Autonomy to manage priorities across countries/time zones; based in Colombia (Bogotá preferred).

Responsabilidades

• Own and improve security compliance programmes, incl. SOC 2, PCI DSS readiness and GDPR requirements.
• Coordinate audit preparation: define scope, manage evidence, drive remediation.
• Own vendor security due diligence from initial risk assessment to ongoing monitoring.
• Lead responses to security questionnaires, partner audits and regulatory requests with stakeholders.
• Keep security risk register, policies and procedures current with actionable remediation plans.
• Own privacy work across the group on data processing agreements and international transfers.
• Translate security/compliance obligations into concrete engineering/business tasks.
• Help build automated workflows and AI-assisted processes to reduce repetitive GRC work with oversight.

Conocimientos

GRC

SOC 2

ISO 27001

PCI DSS

GDPR

Policy writing

Audits & regs

Regulatory coordination

Spanish fluency

English communication

Herramientas

GRC platforms—OneTrust

GRC platforms—Drata

GRC platforms—Vanta

Descripción del empleo

What we're looking for

You'll help shape how ARQ manages security governance, risk and compliance across the group. Based in Colombia, you'll work directly with our group CISO and a global security team, owning programmes that support our growth across multiple markets.

We're looking for someone who takes ownership beyond preparing for an audit. You'll turn framework requirements into practical controls, work with engineers to close gaps, and give partners, auditors and regulators a clear picture of how we manage security. You'll also help us automate repetitive work, from evidence collection and questionnaires to vendor reviews.

This is an individual contributor role with broad ownership and a path towards leading GRC as the function grows.

What you'll do

• Own and improve security compliance programmes, including SOC 2, PCI DSS readiness and GDPR-related requirements.

• Coordinate audit preparation and delivery: define scope, work with control owners, maintain evidence and drive findings through to remediation.

• Own the vendor security due diligence programme, from initial risk assessment and security reviews to ongoing monitoring and reassessment.

• Lead responses to security questionnaires, partner audits and regulatory requests, working with regional stakeholders and the group security team.

• Keep the security risk register, policies and procedures current, with clear owners and actionable remediation plans.

• Own privacy work across the group, partnering with relevant teams on data processing agreements, international transfers and breach notification requirements.

• Translate security and compliance obligations into concrete tasks for engineering and business teams.

• Help build automated workflows and AI-assisted processes that reduce repetitive GRC work while maintaining evidence quality and human oversight.

What you'll need

• 5+ years in information security GRC, IT audit or cyber risk, including at least 2 years in financial services.

• Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, alongside working knowledge of PCI DSS.

• A practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notification.

• Experience running vendor security reviews and interpreting SOC 2 reports, including exceptions and complementary user entity controls.

• The ability to write clear policies and procedures and turn control requirements into practical actions for engineers.

• Experience working directly with auditors or regulators and managing findings through to closure.

• Spanish fluency sufficient to lead discussions with regulators and auditors, alongside professional English for working with a global team.

• The autonomy to manage priorities and drive programmes forward while working with colleagues across countries and time zones.

• Based in Colombia, preferably Bogotá, with the right to work there.

Nice to have

• Experience within an SFC-supervised entity or a fintech undergoing SFC licensing.

• Exposure to other LatAm regulators, such as CNBV, BCRA or BCB.

• Experience implementing ISO 27001 or supporting PCI DSS assessments.

• Familiarity with GRC platforms such as Vanta, Drata or OneTrust.

• Enough AWS and cloud security knowledge to assess engineering evidence and challenge gaps.

• Experience automating GRC workflows.

• Portuguese language skills.

Benefits

• Competitive salary and benefits

• Stock options, so you own part of what you build

• Discretionary performance bonus

• The latest tools and technology

• A world-class team that will challenge and grow your skills

• The opportunity to help build the best fintech app in Latin America

• Office Policy: 3-4 days a week in-office