Security Compliance Analyst

This is a fully remote position, open to applicants in Chile.

📋 Description

• Report directly to the CISO

• Develop and maintain the documentation of the Information Security Management System (ISMS) including policies, procedures, standards, and baselines, ensuring version control, review, and approval

• Maintain the Statement of Applicability (SoA) and traceability between the controls of Annex A of ISO 27001:2022, internal policies, and evidence

• Support the ISO 27001 certification process including gap assessments, closure planning, evidence preparation, and stage 1 and 2 audits

• Coordinate internal audits and manage external audits, fiscal reviews, regulatory assessments, and investor due diligence, ensuring follow-up on findings until resolution

• Identify and assess security risks, maintain the risk matrix, and monitor treatment plans

• Test the design and effectiveness of controls and report ISMS indicators to the Cybersecurity Committee

• Design and execute the annual awareness plan: training sessions, security inductions, and phishing simulations

• Assist Compliance and Legal teams with regulatory reporting and personal data protection

⛳️ Requirements

• Professional degree in Systems Engineering, Computer Science, or related fields

• 2 to 4 years of experience in GRC, IT auditing, information security, or technological risk

• Hands-on experience with ISO 27001: having participated in the implementation, maintenance, or auditing of an ISMS

• Experience in drafting policies and procedures for a management system

• Experience supporting audits and managing findings to closure

• Experience in risk assessment (risk matrix and treatment plans)

• Technical reading proficiency in English

• Native Spanish speaker

• ISO 27001 Lead Implementer, Lead Auditor, or Internal Auditor certification, or certifications such as CISA, CRISC, or CISM (adds value)

• Experience in fintech, banking, or other regulated industries (CMF, SFC or similar) (adds value)

• Experience in an end-to-end ISO 27001 certification process (adds value)

• Knowledge of personal data protection (Law 21.719, Law 1581, GDPR) and GRC tools such as Vanta (adds value)

• Experience designing awareness programs or simulated phishing campaigns (adds value)

🏝️ Benefits

• Indefinite contract

• 40 hours/week

• 35 days of annual vacation

• 100% remote work from LATAM

• Unlimited personal days off

• Direct impact on building the Cybersecurity function of a growing fintech