Remote Internal Audit & Compliance Lead - ISO 27001 & SOC 2

Otonomee; Colombia; A distancia; COP 120.000.000 - 180.000.000; Jornada completa

Descripción de la vacante

Otonomee is seeking an experienced Internal Audit & Compliance Manager to own governance, risk and compliance programmes across ISO 27001, PCI DSS and SOC 2. You will manage audits, controls, and evidence to enable continuous certification and client assurance.

The role reports to the CTO with an independent line to the CEO, coordinating across technology, operations and corporate functions to translate requirements into practical controls and timely remediation.

Formación

• 8+ years in internal audit, GRC, or information-security compliance.
• Hands-on ISO/IEC 27001 ISMS implementation and remediation roadmaps.
• Practical PCI DSS and SOC 2 experience.
• Experience with a GRC/automation platform (Drata or equivalent).

Responsabilidades

• Establish and run a planned internal audit programme across ISO 27001, PCI DSS, SOC 2.
• Provide independent assurance to CTO, CEO, and senior leadership on control effectiveness.
• Maintain audit readiness and coordinate external audits end to end.
• Conduct risk assessments; develop and track KRIs and mitigation plans.
• Drive remediation of control gaps with process owners and tech teams.
• Prepare compliance reports for leadership, board, auditors and clients.
• Run third-party and vendor risk reviews and ongoing monitoring.
• Own security questionnaires and RFP compliance responses.

Conocimientos

Internal audit

GRC

Information security

ISO 27001

SOC 2

PCI DSS

Risk assessment

Educación

Internal-auditor qualification

Herramientas

Drata

Descripción del empleo

Otonomee is seeking an experienced Internal Audit & Compliance Manager to own governance, risk and compliance programmes across ISO 27001, PCI DSS and SOC 2. You will manage audits, controls, and evidence to enable continuous certification and client assurance.

The role reports to the CTO with an independent line to the CEO, coordinating across technology, operations and corporate functions to translate requirements into practical controls and timely remediation.