Information Security Engineer GRC
ARQ is a financial services platform that lets users in Latin America hold global currencies, make cross-border payments, invest in international markets, and spend worldwide with a card.
Funding history
Projects
About ARQ ( Prev DolarApp )
ARQ serves travelers, investors, and professionals across Latin America who need access to global currencies and financial markets. Users can hold digital dollars and euros, receive and send international payments via dedicated US and European account details, invest in US stocks and ETFs, and spend globally with a card at market conversion rates. The platform is available across Mexico, Argentina, Colombia, and Brazil.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will own and improve compliance programs, coordinate audits, maintain evidence, and drive remediation. You will manage vendor security due diligence, respond to security and regulatory requests, maintain risk records and policies, and translate requirements into practical work. You will also automate GRC workflows while maintaining evidence quality and oversight.
Requirements
- 5+ years of experience in information security GRC, IT audit, or cyber risk
- At least 2 years of financial-services experience
- Experience coordinating SOC 2 or ISO 27001 audits and evidence collection
- Working knowledge of PCI DSS
- Practical GDPR knowledge, including lawful basis, data processing agreements, transfers, and breach notification
- Experience running vendor security reviews and interpreting SOC 2 reports
- Experience writing policies and procedures and translating controls into practical actions
- Experience working with auditors or regulators and closing findings
- Spanish fluency and professional English
- Based in Colombia, preferably Bogotá, with the right to work there
Responsibilities
- Own and improve SOC 2, PCI DSS, and GDPR compliance programs
- Coordinate audit preparation, evidence collection, and remediation
- Manage vendor security due diligence and ongoing monitoring
- Lead responses to security questionnaires, partner audits, and regulatory requests
- Maintain security risk registers, policies, and procedures
- Manage privacy work, including data processing agreements, transfers, and breach notifications
- Translate compliance obligations into engineering and business tasks
- Build automated and AI-assisted GRC workflows
Benefits
- Stock options
- Discretionary performance bonus
- Latest tools and technology