Information Security Engineer | GRC

What we're looking for You'll help shape how ARQ manages security governance, risk and compliance across the group. Based in Colombia, you'll work directly with our group CISO and a global security team, owning programmes that support our growth across multiple markets. We're looking for someone who takes ownership beyond preparing for an audit. You'll turn framework requirements into practical controls, work with engineers to close gaps, and give partners, auditors and regulators a clear picture of how we manage security. You'll also help us automate repetitive work, from evidence collection and questionnaires to vendor reviews. This is an individual contributor role with broad ownership and a path towards leading GRC as the function grows. What you'll do Own and improve security compliance programmes, including SOC 2, PCI DSS readiness and GDPR-related requirements. Coordinate audit preparation and delivery: define scope, work with control owners, maintain evidence and drive findings through to remediation. Own the vendor security due diligence programme, from initial risk assessment and security reviews to ongoing monitoring and reassessment. Lead responses to security questionnaires, partner audits and regulatory requests, working with regional stakeholders and the group security team. Keep the security risk register, policies and procedures current, with clear owners and actionable remediation plans. Own privacy work across the group, partnering with relevant teams on da