What we're looking for
You'll help shape how ARQ manages security governance, risk and compliance across the group. Based in Colombia, you'll work directly with our group CISO and a global security team, owning programmes that support our growth across multiple markets.
We're looking for someone who takes ownership beyond preparing for an audit. You'll turn framework requirements into practical controls, work with engineers to close gaps, and give partners, auditors and regulators a clear picture of how we manage security. You'll also help us automate repetitive work, from evidence collection and questionnaires to vendor reviews.
This is an individual contributor role with broad ownership and a path towards leading GRC as the function grows.
What you'll need
- 5+ years in information security GRC, IT audit or cyber risk, including at least 2 years in financial services.
- Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, alongside working knowledge of PCI DSS.
- A practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notification.
- Experience running vendor security reviews and interpreting SOC 2 reports, including exceptions and complementary user entity controls.
- The ability to write clear policies and procedures and turn control requirements into practical actions for engineers.
- Experience working directly with auditors or regulators and managing findings through to closure.
- Spanish fluency sufficient to lead discussions with regulators and auditors, alongside professional English for working with a global team.
- The autonomy to manage priorities and drive programmes forward while working with colleagues across countries and time zones.
- Based in Colombia, preferably Bogotá, with the right to work there.