{"id":3538957,"url":"https://alion.io/job/arq-information-security-engineer-grc","title":"Information Security Engineer | GRC","company":{"id":450345,"name":"ARQ","domain":"arqfinance.com","url":"https://alion.io/company/arq-2","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":84,"open_postings":6,"ghost_share":0,"stale_share":0.833,"repost_share":0,"time_to_fill_p50_days":14,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Bogotá, Colombia"],"countries":["CO"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":25000,"max_usd":57000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false},{"name":"AWS","optional":true}],"status":"live","first_seen_at":"2026-10-30T14:44:56Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-02T08:36:12Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"What we're looking for\nYou'll help shape how ARQ manages security governance, risk and compliance across the group. Based in Colombia, you'll work directly with our group CISO and a global security team, owning programmes that support our growth across multiple markets.\nWe're looking for someone who takes ownership beyond preparing for an audit. You'll turn framework requirements into practical controls, work with engineers to close gaps, and give partners, auditors and regulators a clear picture of how we manage security. You'll also help us automate repetitive work, from evidence collection and questionnaires to vendor reviews.\nThis is an individual contributor role with broad ownership and a path towards leading GRC as the function grows.\nWhat you'll do\nOwn and improve security compliance programmes, including SOC 2, PCI DSS readiness and GDPR-related requirements.\n\nCoordinate audit preparation and delivery: define scope, work with control owners, maintain evidence and drive findings through to remediation.\n\nOwn the vendor security due diligence programme, from initial risk assessment and security reviews to ongoing monitoring and reassessment.\n\nLead responses to security questionnaires, partner audits and regulatory requests, working with regional stakeholders and the group security team.\n\nKeep the security risk register, policies and procedures current, with clear owners and actionable remediation plans.\n\nOwn privacy work across the group, partnering with relevant teams on data processing agreements, international transfers and breach notification requirements.\n\nTranslate security and compliance obligations into concrete tasks for engineering and business teams.\n\nHelp build automated workflows and AI-assisted processes that reduce repetitive GRC work while maintaining evidence quality and human oversight.\n\nWhat you'll need\n5+ years in information security GRC, IT audit or cyber risk, including at least 2 years in financial services.\n\nExperience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, alongside working knowledge of PCI DSS.\n\nA practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notification.\n\nExperience running vendor security reviews and interpreting SOC 2 reports, including exceptions and complementary user entity controls.\n\nThe ability to write clear policies and procedures and turn control requirements into practical actions for engineers.\n\nExperience working directly with auditors or regulators and managing findings through to closure.\n\nSpanish fluency sufficient to lead discussions with regulators and auditors, alongside professional English for working with a global team.\n\nThe autonomy to manage priorities and drive programmes forward while working with colleagues across countries and time zones.\n\nBased in Colombia, preferably Bogotá, with the right to work there.\n\nNice to have\nExperience within an SFC-supervised entity or a fintech undergoing SFC licensing.\n\nExposure to other LatAm regulators, such as CNBV, BCRA or BCB.\n\nExperience implementing ISO 27001 or supporting PCI DSS assessments.\n\nFamiliarity with GRC platforms such as Vanta, Drata or OneTrust.\n\nEnough AWS and cloud security knowledge to assess engineering evidence and challenge gaps.\n\nExperience automating GRC workflows.\n\nPortuguese language skills.\n\nBenefits\nCompetitive salary and benefits\n\nStock options, so you own part of what you build\n\nDiscretionary performance bonus\n\nThe latest tools and technology\n\nA world-class team that will challenge and grow your skills\n\nThe opportunity to help build the best fintech app in Latin America\n\nOffice Policy: 3-4 days a week in-office","description_format":"text","description_chars":3733,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Portuguese","level":"All levels","optional":true},{"language":"Spanish","level":"Advanced (C1)","optional":false}]},"benefits":["Stock options"],"hiring_locations":[{"name":"Colombia","iso":"CO","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Stablecoins","Digital Banks & Neobanks","Currency Exchange & FX Payments"],"lifecycle":[{"event":"open","at":"2026-10-30T18:38:43Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":14,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/arq-information-security-engineer-grc","json_url":"https://alion.io/job/arq-information-security-engineer-grc.json","meta":{"generated_at":"2026-11-02T10:50:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15073,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":450345},"rest":"https://alion.io/mcp/rest/get_company?id=450345"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farq-information-security-engineer-grc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farq-information-security-engineer-grc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farq-information-security-engineer-grc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arq-information-security-engineer-grc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farq-information-security-engineer-grc"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3538957}},{"tool":"search_jobs","arguments":{"company":"arqfinance.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3538957},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}