GRC Engineer

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Develop, implement, and continually enhance information security governance, risk management, compliance, and assurance processes.

• Facilitate adherence to frameworks and standards such as ISO 27001, ISO 27002, SOC 2, and other relevant requirements.

• Perform risk assessments, assess security controls, maintain risk registers, and oversee risk treatment and remediation efforts.

• Assist with internal and external audits, certification processes, evidence collection, and ongoing compliance monitoring.

• Create and uphold security policies, standards, procedures, and governance documentation.

• Enhance Business Continuity Management (BCM), Disaster Recovery (DR), Incident Response (IR), and Third-Party Risk Management (TPRM) initiatives, which include gap analysis, planning, exercises, and testing.

• Evaluate secure software development practices and partner with Engineering teams to embed security and compliance requirements within the Software Development Lifecycle (SDLC).

• Execute customer security and compliance due diligence, which encompasses security questionnaires, RFPs, and contractual security evaluations.

• Recognize and implement opportunities to automate GRC processes utilizing AI, APIs, integrations, and other technological solutions.

• Work collaboratively with Engineering, Infrastructure, Security, Product, and business teams to embed security and compliance requirements into operational and technical processes.

⛳️ Requirements

• Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or related areas.

• Demonstrated hands-on experience in executing or enhancing information security governance, risk management, and compliance initiatives.

• Familiarity with ISO 27001 / ISO 27002, SOC 2, or similar security frameworks.

• Proven hands-on experience in Information Security Risk Management, including risk assessments, risk treatment, control evaluation, and remediation management.

• Practical experience in implementing or maintaining Business Continuity Management (BCM) and Disaster Recovery (DR) processes, including BIA, RTO/RPO, recovery planning, and testing.

• Hands-on experience with Incident Response (IR) processes, including incident management, response protocols, exercises, and post-incident enhancements.

• Experience conducting Third-Party Risk Management (TPRM) assessments, evaluating vendor security controls, and managing related risks.

• Knowledge of data protection and privacy regulations, including LGPD and GDPR.

• Understanding of assessing Secure Software Development practices, including SDLC security controls, code review processes, and vulnerability management.

• Comprehension of cloud infrastructure concepts, identity and access management, and cybersecurity fundamentals.

• Experience in supporting internal or external audits, compliance evaluations, and evidence management processes.

• Capability to independently assess risks, evaluate controls, and drive improvements across various GRC domains.

• Ability to utilize AI and automation tools to enhance workflows, address challenges, and boost operational efficiency.

• Proficient in both Portuguese and English at an advanced level.

🏝️ Benefits

• Competitive Compensation

• 30 days of paid annual leave

• Education and courses stipend

• Earn a trip anywhere in the world every 4 years

• R$1.035/month for meals allowance

• Health plan with national coverage and no copayment

• Dental Insurance: we assist you with dental treatment for enhanced quality of life.

• Wellhub Membership: Access to a broad range of gyms and training programs.