Information Security Engineer - GRC

About the role

ARQ is looking for an Information Security Engineer focused on security governance, risk and compliance (GRC), based in Colombia and working directly with the group CISO and a global security team. This is an individual contributor role with broad ownership and a path towards leading GRC as the function grows.

Key responsibilities

• Own and improve security compliance programmes, including SOC 2, PCI DSS readiness and GDPR requirements.
• Coordinate audit preparation and delivery: define scope, work with control owners, maintain evidence and drive findings to remediation.
• Own the vendor security due diligence programme, from risk assessment and security reviews to ongoing monitoring.
• Lead responses to security questionnaires, partner audits and regulatory requests.
• Keep the security risk register, policies and procedures current, with clear owners and remediation plans.
• Own privacy work across the group, including data processing agreements, international transfers and breach notification.
• Translate security obligations into tasks for engineering and business teams, and help build automated workflows and AI-assisted processes.

Required profile

• 5+ years in information security GRC, IT audit or cyber risk, including at least 2 years in financial services.
• Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, with working knowledge of PCI DSS.
• Practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notification.
• Experience running vendor security reviews and interpreting SOC 2 reports, including exceptions and complementary user entity controls.
• Ability to write clear policies and procedures and to work with auditors or regulators until findings are closed.
• Spanish fluency to lead discussions with regulators and auditors, plus professional English; right to work in Colombia, preferably Bogotá.

Required skills

• SOC 2, ISO 27001, PCI DSS and GDPR
• GRC platforms such as Vanta, Drata or OneTrust (nice to have)
• AWS and cloud security knowledge (nice to have)
• Experience automating GRC workflows (nice to have)

What we offer

• Competitive salary and benefits, plus stock options and a discretionary performance bonus.
• Latest tools and technology, and a chance to help build the fintech app in Latin America.
• Office policy of 3-4 days a week in the office.