Arq

Information Security Engineer | GRC

Bogota, Remote. Posted 2 days ago

The role

You will manage security governance, risk, and compliance across the group. You will own compliance programmes, coordinate audits, and manage vendor security due diligence.

What you will do

  • Own and improve security compliance programmes, including SOC 2, PCI DSS readiness and GDPR-related requirements.
  • Coordinate audit preparation and delivery.
  • Own the vendor security due diligence programme.
  • Lead responses to security questionnaires, partner audits and regulatory requests.
  • Keep the security risk register, policies and procedures current.
  • Own privacy work across the group.
  • Translate security and compliance obligations into concrete tasks for engineering and business teams.
  • Help build automated workflows and AI-assisted processes.

Required qualifications

  • 5+ years in information security GRC, IT audit or cyber risk, including at least 2 years in financial services.
  • Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, alongside working knowledge of PCI DSS.
  • A practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notification.
  • Experience running vendor security reviews and interpreting SOC 2 reports, including exceptions and complementary user entity controls.
  • The ability to write clear policies and procedures and turn control requirements into practical actions for engineers.
  • Experience working directly with auditors or regulators and managing findings through to closure.
  • Spanish fluency sufficient to lead discussions with regulators and auditors.
  • Professional English for working with a global team.
  • The autonomy to manage priorities and drive programmes forward while working with colleagues across countries and time zones.
  • Based in Colombia, with the right to work there.

Nice to have

  • Experience within an SFC-supervised entity or a fintech undergoing SFC licensing.
  • Exposure to other LatAm regulators, such as CNBV, BCRA or BCB.
  • Experience implementing ISO 27001 or supporting PCI DSS assessments.
  • Familiarity with GRC platforms such as Vanta, Drata or OneTrust.
  • Enough AWS and cloud security knowledge to assess engineering evidence and challenge gaps.
  • Experience automating GRC workflows.
  • Portuguese language skills.
  • Preferably Bogotá

Benefits

  • Competitive salary and benefits
  • Stock options
  • Discretionary performance bonus
  • The latest tools and technology
  • A world-class team that will challenge and grow your skills
  • The opportunity to help build the best fintech app in Latin America

About the company

arq is a fintech company building an app in Latin America.