Information Security Engineer | GRC
Core
Shape security governance, risk, and compliance (GRC) programs for a fintech group, turning framework requirements into practical controls and automating evidence collection.
Role type
Individual contributor GRC engineer
Builds
Security compliance programs (SOC 2, PCI DSS, GDPR), vendor due diligence, and automated GRC workflows
Domain
Financial services / Information Security
Required skills
GRC program ownership, audit coordination (SOC 2, ISO 27001), vendor security due diligence, privacy compliance (GDPR), policy writing, regulatory liaison, automation of GRC tasks
Preferred skills
Fintech regulatory experience (SFC, CNBV, BCRA), GRC platform usage (Vanta, Drata, OneTrust), cloud security assessment (AWS), Portuguese language
Technologies
SOC 2, PCI DSS, ISO 27001, GDPR, Vanta, Drata, OneTrust, AWS
Responsibilities
Own and improve security compliance programmes, coordinate audit preparation and delivery, manage vendor security due diligence, lead responses to security questionnaires and regulatory requests, maintain security risk register and policies, own privacy work across the group, translate obligations into tasks for engineering teams, build automated GRC workflows
Seniority
Mid-Senior, hands-on IC