Information Security Engineer (GRC, Fintech)

Location: Hybrid in Colombia, preferably Bogotá, with 3–4 days per week in the office

Company

hirify.global is building a fintech app for Latin America.

What you will do

• Own and improve security compliance programmes covering SOC 2, PCI DSS readiness and GDPR-related requirements.
• Coordinate audits by defining scope, managing evidence and control owners, and driving findings through remediation.
• Run vendor security due diligence, including risk assessments, security reviews, monitoring and reassessments.
• Lead responses to security questionnaires, partner audits and regulatory requests with regional stakeholders and the group security team.
• Maintain the security risk register, policies and procedures, and translate requirements into practical engineering and business tasks.
• Own privacy work and build automated and AI-assisted GRC workflows while maintaining evidence quality and human oversight.

Requirements

• 5+ years of experience in information security GRC, IT audit or cyber risk, including at least 2 years in financial services.
• Experience owning evidence collection and coordinating control owners through a SOC 2 or ISO 27001 audit, with working knowledge of PCI DSS.
• Practical understanding of GDPR, including lawful basis, data processing agreements, international transfers and breach notifications.
• Experience running vendor security reviews and interpreting SOC 2 reports, including exceptions and complementary user entity controls.
• Ability to write clear policies and procedures and turn control requirements into practical actions for engineers.
• Experience working directly with auditors or regulators and managing findings through closure.
• Spanish fluency sufficient to lead discussions with regulators and auditors, plus professional English for global-team collaboration.
• Autonomy to manage priorities and drive programmes forward across countries and time zones.
• Must be based in Colombia, preferably Bogotá, and have the right to work there.

Nice to have

• Experience within an SFC-supervised entity or a fintech undergoing SFC licensing.
• Exposure to LatAm regulators such as CNBV, BCRA or BCB.
• Experience implementing ISO 27001 or supporting PCI DSS assessments.
• Familiarity with GRC platforms such as Vanta, Drata or OneTrust.
• AWS and cloud security knowledge sufficient to assess engineering evidence and challenge gaps.
• Experience automating GRC workflows.
• Portuguese language skills.

Culture & Benefits

• Full-time hybrid role with 3–4 days per week in the office.
• Competitive salary and benefits, plus a discretionary performance bonus.
• Stock options and access to modern tools and technology.
• Opportunity to work with a global security team and contribute to a fintech product for Latin America.