What we're looking for

Help shape how ARQ manages security governance, risk and compliance across the group
Based in Colombia, working directly with our group CISO and a global security team
Own programmes that support our growth across multiple markets
Take ownership beyond preparing for an audit
Turn framework requirements into practical controls
Work with engineers to close gaps
Give partners, auditors and regulators a clear picture of how we manage security
Help automate repetitive work, from evidence collection and questionnaires to vendor reviews
Individual contributor role with broad ownership and a path towards leading GRC as the function grows

What you'll do

Own and improve security compliance programmes, including SOC 2, PCI DSS readiness and GDPR-related requirements
Coordinate audit preparation and delivery: define scope, work with control owners, maintain evidence and drive findings through to remediation
Own the vendor security due diligence programme, from initial risk assessment and security reviews to ongoing monitoring and reassessment
Lead responses to security questionnaires, partner audits and regulatory requests, working with regional stakeholders and the group security team
Keep the security risk register, policies and procedures current, with clear owners and actionable remediation plans
Own privacy work across the group, partnering with relevant teams on data processing agreements, international transfers and breach notification requirements
Translate security and compliance obligations into concrete tasks for engineering and business teams
Help build automated workflows and AI-assisted processes that reduce repetitive GRC work while maintaining evidence quality and human oversight

5+ years in information security GRC, IT audit or cyber risk, including at least 2 years in financial services
Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, alongside working knowledge of PCI DSS
A practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notification
Experience running vendor security reviews and interpreting SOC 2 reports, including exceptions and complementary user entity controls
The ability to write clear policies and procedures and turn control requirements into practical actions for engineers
Experience working directly with auditors or regulators and managing findings through to closure
Spanish fluency sufficient to lead discussions with regulators and auditors, alongside professional English for working with a global team
The autonomy to manage priorities and drive programmes forward while working with colleagues across countries and time zones
Based in Colombia, preferably Bogotá, with the right to work there

Experience within an SFC-supervised entity or a fintech undergoing SFC licensing
Exposure to other LatAm regulators, such as CNBV, BCRA or BCB
Experience implementing ISO 27001 or supporting PCI DSS assessments
Familiarity with GRC platforms such as Vanta, Drata or OneTrust
Enough AWS and cloud security knowledge to assess engineering evidence and challenge gaps
Experience automating GRC workflows
Portuguese language skills

Imported from ARQ’s job posting on jobs.ashbyhq.com. Apply sends you to the original listing.