Information Security Engineer | GRC
ARQ is a financial services platform that lets users in Latin America hold global currencies, make cross-border payments, invest in international markets, and spend worldwide with a card.
Funding history
Projects
About ARQ ( Prev DolarApp )
ARQ serves travelers, investors, and professionals across Latin America who need access to global currencies and financial markets. Users can hold digital dollars and euros, receive and send international payments via dedicated US and European account details, invest in US stocks and ETFs, and spend globally with a card at market conversion rates. The platform is available across Mexico, Argentina, Colombia, and Brazil.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You'll help shape how security governance, risk and compliance is managed across the group, working directly with the group CISO and a global security team. You'll turn framework requirements into practical controls, work with engineers to close gaps, and give partners, auditors and regulators a clear picture of security. You'll also help automate repetitive work such as evidence collection, questionnaires and vendor reviews. This is an individual contributor role with broad ownership and a path towards leading GRC.
Requirements
- 5+ years in information security GRC, IT audit or cyber risk, including at least 2 years in financial services
- Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, plus working knowledge of PCI DSS
- Practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notification
- Experience running vendor security reviews and interpreting SOC 2 reports
- Ability to write clear policies and procedures and turn control requirements into practical actions
- Experience working with auditors or regulators and managing findings to closure
- Spanish fluency to lead discussions with regulators and auditors, and professional English
- Autonomy to manage priorities and drive programmes across countries and time zones
- Based in Colombia, preferably Bogotá, with the right to work there
Responsibilities
- Own and improve security compliance programmes, including SOC 2, PCI DSS readiness and GDPR-related requirements
- Coordinate audit preparation and delivery: define scope, work with control owners, maintain evidence and drive findings to remediation
- Own the vendor security due diligence programme, from risk assessment to ongoing monitoring and reassessment
- Lead responses to security questionnaires, partner audits and regulatory requests
- Keep the security risk register, policies and procedures current with clear owners and remediation plans
- Own privacy work across the group, including data processing agreements, international transfers and breach notification
- Translate security and compliance obligations into concrete tasks for engineering and business teams
- Build automated workflows and AI-assisted processes that reduce repetitive GRC work
Benefits
- Competitive salary and benefits
- Stock options
- Discretionary performance bonus
- The latest tools and technology