GRC Engineer (AI)

Location: Remote, based in São Paulo, Brazil

Compensation includes R$1.035 per month for meals.

Company

hirify.global builds hardware, AI, and software for asset-heavy industries, helping more than 2,000 facilities manage industrial equipment and reduce downtime.

What you will do

• Develop and improve information security governance, risk management, compliance, and assurance processes.
• Support ISO 27001, ISO 27002, SOC 2, audits, certification activities, evidence collection, and continuous compliance monitoring.
• Conduct risk assessments, evaluate controls, maintain risk registers, and coordinate remediation.
• Improve BCM, DR, IR, and TPRM activities, including gap analysis, planning, exercises, testing, and vendor assessments.
• Assess secure software development practices and integrate security and compliance requirements into the SDLC with Engineering teams.
• Automate GRC workflows using AI, APIs, integrations, and other technologies while supporting customer security due diligence.

Requirements

• Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or a related field.
• Hands-on experience implementing or improving information security governance, risk management, and compliance programs.
• Experience with ISO 27001, ISO 27002, SOC 2, or equivalent frameworks.
• Hands-on information security risk management experience, including risk assessments, risk treatment, control evaluation, and remediation management.
• Practical BCM and DR experience, including BIA, RTO/RPO, recovery planning, and testing.
• Hands-on IR experience, including incident management, response procedures, exercises, and post-incident improvement.
• Experience with TPRM assessments, vendor security controls, and associated risk management.
• Knowledge of data protection and privacy requirements, including LGPD and GDPR; understanding of secure software development, SDLC controls, code review, and vulnerability management.
• Understanding of cloud infrastructure, identity and access management, and cybersecurity concepts.
• Experience supporting audits, compliance assessments, and evidence management.
• Ability to independently assess risks, evaluate controls, drive improvements across GRC domains, and use AI and automation to improve workflows.
• Advanced Portuguese and English proficiency required.

Nice to have

• Experience with GRC platforms such as Vanta or Drata.
• Experience with Policy-as-Code or Compliance-as-Code.
• Familiarity with AWS, OCI, GCP, IaC, CI/CD pipelines, and Git-based workflows.
• Experience building AI-assisted workflows or using LLMs and AI agents for GRC automation.
• Knowledge of ISO 22301, ISO 27701, ISO 42001, NIST CSF, or FedRAMP.
• Recognized security, risk management, or compliance certifications.

Culture & Benefits

• Remote work from Brazil, based in São Paulo.
• 30 days of paid annual leave.
• Education and courses stipend.
• Health plan with national coverage and no coparticipation, plus dental insurance.
• Wellhub membership and R$1.035 monthly meals allowance.
• Trip anywhere in the world earned every four years.