Security Compliance Analyst

Masabi; Colombia; Remote; COP 42,000,000 - 65,000,000; Full time

Job summary

Masabi is hiring a Security Compliance Analyst for a fully remote role based in Colombia. You will own end-to-end security control processes, perform both manual and automated controls, and support audits and client security questionnaires.

You will help maintain evidence, registers and documentation, and explore automation using AI tools to streamline compliance across ISO 27001, SOC 2, PCI DSS, and NIST frameworks.

Qualifications

• Hands-on information security, IT compliance, internal control or audit experience.
• Experience preparing evidence for audits against frameworks such as ISO 27001, SOC 2, PCI DSS or NIST.
• Understanding of access control, risk management, third-party risk and data protection.
• Detail-oriented, organized and able to manage multiple recurring tasks.

Responsibilities

• Own a set of security control processes end to end: plan, execute, evidence, track findings to resolution.
• Perform manual and tool-based security controls to close gaps and ensure consistency.
• Carry out user access reviews and document results and actions.
• Run Third-Party Risk Management activities: assess suppliers, track risks, schedule reassessments.
• Maintain security and privacy registers accurate and current.
• Assist in bid/tender responses with clear, accurate security information.
• Respond to security questionnaires from customers and audits.
• Support audits and certifications (ISO 27001, SOC 2, PCI DSS, NIST) with evidence.
• Identify opportunities to automate controls and introduce AI-assisted improvements.

Skills

Information security

IT compliance

Audit

Access control

Risk management

Data protection

Documentation

Technical writing

Ownership

Tools

Vanta

AWS

Jira

Confluence

Job description

// At Masabi, we’re driving the fare payment revolution, powering the journeys of millions all over the world. We build fare collection platforms that allow riders to seamlessly buy and present tickets for public transport either on their mobile phones, from a ticket machine, or even by tapping their bank card to travel.

The Role_

You will join the Security team at Masabi. Masabi builds Justride, a mobile ticketing and fare collection platform used by public transport authorities and agencies around the world. Our customers trust us with their riders’ data and payments, so security and compliance are central to our business.

As a Security Compliance Analyst, you will help us run our security controls consistently and on time. You will own a set of assigned control processes from start to finish, carry out reviews, run day-to-day third-party risk activities and support our commercial teams when customers and prospects ask about our security.

You will work with growing autonomy, with guidance from the team on priorities and new areas of work. You will be a point of contact for day-to-day compliance questions and help improve how we maintain evidence, registers and documentation. You will also help us make compliance work faster, more consistent and easier to scale through automation and AI. This role is a good fit for someone who is careful, organised and pragmatic, and who enjoys turning frameworks and requirements into simple, repeatable processes that people actually follow.

Location_

// This role is only available to candidates based in Colombia in a fully remote model.

Responsibilities_

• Own a set of assigned security control processes end to end: plan them, carry them out, gather evidence, and track findings until they’re resolved with clear ownership.
• Perform manual and tool-based security controls, helping us close gaps where controls are missing or not run consistently.
• Carry out regular reviews, such as user access reviews, and make sure results and actions are recorded.
• Run day-to-day Third-Party Risk Management (TPRM) activities: assessing new and existing suppliers, reviewing their security posture, tracking risks and scheduling reassessments.
• Keep our security and privacy registers (supplier, risk, asset and data processing) accurate and current.
• Help analyse security and privacy requirements in bids and tenders from transport agencies, working with the wider team to prepare clear, accurate answers.
• Respond to security questionnaires and information requests from existing customers.
• Support audits and certifications (such as ISO 27001, ISO 27017/27018, AICPA SOC 2, PCI DSS, NIST CSF and Cyber Essentials) by preparing evidence and documentation.
• Spot opportunities to automate or improve control processes, including with AI tools, and help put them in place.

About You_

• Hands-on experience in information security, IT compliance, internal control or audit, including running control processes yourself rather than only supporting others.
• Practical experience preparing evidence for audits or assessments against at least one recognised framework, such as ISO 27001, SOC 2, PCI DSS or NIST.
• A working understanding of access control, risk management, third-party risk and data protection.
• Detail-oriented and consistent: you follow a process carefully and don’t let things slip through the cracks.
• Organised enough to juggle several recurring tasks and deadlines at once.
• Curious about technology, with a habit of learning how systems, cloud services and SaaS tools fit together.
• Clear writing and a knack for structuring information, whether that’s documentation, registers or questionnaire answers.
• Comfortable taking ownership of your work, and not afraid to ask questions when something isn’t clear.

We don’t expect you to tick every box. What matters most is curiosity, a willingness to learn, and the motivation to take ownership of your work.

Nice to Have_

• Experience with Third-Party Risk Management or vendor security assessments.
• Knowledge of frameworks such as ISO 27001, SOC 2, PCI DSS, GDPR or NIST, and experience mapping controls across them.
• Experience supporting RFPs, tenders or customer security questionnaires.
• Hands-on experience with compliance automation or GRC platforms (for control monitoring, evidence collection and audit management).
• Interest in automation, such as scripting, low-code tools (e.g. n8n, Make) or using AI to improve workflows.
• Experience with Vanta, AWS, Jira or Confluence.
• A relevant certification such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC, CISSP or Security+.
• Experience in SaaS, payments, public transport or public sector environments.

AI at Masabi_

// AI is becoming part of how we work at Masabi. You don’t need professional experience using AI tools, but we’d expect you’ve experimented with them and are curious about how they can help you learn, solve problems, and work more effectively.

Why Join Masabi?

• Driven by Purpose – We believe in journeys made simple. The work isn’t always easy, but the best things never are.
• Encouraged to Accelerate – Masabi is going places and our people are in the driving seat. Whether you’re taking the direct route or exploring new paths, we support your journey.
• Advancing with Empathy – We put people first and foster a culture of learning, not blame. No matter your cargo, we share the load.

We’re already powering journeys - are you ready to join us?