Security Compliance Analyst

About the role

Masabi builds Justride, a mobile ticketing and fare collection platform used by public transport authorities worldwide. As a Security Compliance Analyst on the Security team, you will help run security controls consistently and on time, owning a set of assigned control processes from start to finish, carrying out reviews, running day-to-day third-party risk activities and supporting commercial teams on security questions. The role is fully remote and open only to candidates based in Colombia.

Key responsibilities

• Own assigned security control processes end to end: plan, execute, gather evidence and track findings until resolved.
• Run manual and tool-based security controls and regular reviews such as user access reviews.
• Manage day-to-day Third-Party Risk Management: assess new and existing suppliers, review their security posture, track risks and schedule reassessments.
• Keep supplier, risk, asset and data processing registers accurate and current.
• Analyse security and privacy requirements in bids and tenders, and respond to security questionnaires from customers.
• Support audits and certifications (ISO 27001, ISO 27017/27018, AICPA SOC 2, PCI DSS, NIST CSF, Cyber Essentials) by preparing evidence and documentation.
• Identify opportunities to automate or improve control processes, including with AI tools.

Required profile

• Hands-on experience in information security, IT compliance, internal control or audit, including running control processes yourself.
• Practical experience preparing evidence for audits against at least one recognised framework such as ISO 27001, SOC 2, PCI DSS or NIST.
• Working understanding of access control, risk management, third-party risk and data protection.
• Detail-oriented, organised, curious about technology and able to take ownership of work.

Required skills

• Nice to have: TPRM or vendor security assessment experience; knowledge of ISO 27001, SOC 2, PCI DSS, GDPR or NIST; RFP and tender support.
• Nice to have: compliance automation or GRC platforms, scripting, low-code tools (n8n, Make), Vanta, AWS, Jira or Confluence.
• Nice to have: certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CISM, CRISC, CISSP or Security+; experience in SaaS, payments, public transport or public sector.