GRC Engineer

• Develop, implement, and continuously improve information security governance, risk management, compliance, and assurance processes.
• Support compliance with frameworks and standards such as ISO 27001, ISO 27002, SOC 2, and other applicable requirements.
• Conduct risk assessments, evaluate security controls, maintain risk registers, and coordinate risk treatment and remediation activities.
• Support internal and external audits, certification processes, evidence collection, and continuous compliance monitoring.
• Develop and maintain security policies, standards, procedures, and governance documentation.
• Improve Business Continuity Management (BCM), Disaster Recovery (DR), Incident Response (IR), and Third-Party Risk Management (TPRM) activities, including gap analysis, planning, exercises, and testing.
• Assess secure software development practices and collaborate with Engineering teams to integrate security and compliance requirements into the Software Development Lifecycle (SDLC).
• Conduct customer security and compliance due diligence, including security questionnaires, RFPs, and contractual security assessments.
• Identify and implement opportunities to automate GRC processes using AI, APIs, integrations, and other technologies.
• Collaborate with Engineering, Infrastructure, Security, Product, and business teams to integrate security and compliance requirements into operational and technical processes.

• Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or related fields.
• Proven hands-on experience implementing or improving information security governance, risk management, and compliance programs.
• Experience with ISO 27001 / ISO 27002, SOC 2, or equivalent security frameworks.
• Proven hands-on experience in Information Security Risk Management, including risk assessments, risk treatment, control evaluation, and remediation management.
• Practical experience implementing or maintaining Business Continuity Management (BCM) and Disaster Recovery (DR) processes, including BIA, RTO/RPO, recovery planning, and testing.
• Hands-on experience with Incident Response (IR) processes, including incident management, response procedures, exercises, and post-incident improvement.
• Experience conducting Third-Party Risk Management (TPRM) assessments, evaluating vendor security controls, and managing associated risks.
• Knowledge of data protection and privacy requirements, including LGPD and GDPR.
• Understanding of assessing Secure Software Development practices, including SDLC security controls, code review processes, vulnerability management, etc.
• Understanding of cloud infrastructure concepts, identity and access management, and cybersecurity concepts.
• Experience supporting internal or external audits, compliance assessments, and evidence management.
• Ability to independently assess risks, evaluate controls, and drive improvements across different GRC domains.
• Ability to leverage AI, automation tools to improve workflows, solve problems, and increase operational efficiency.
• Advanced Portuguese and English proficiency.

• Competitive Compensation
• 30 days of paid annual leave
• Education and courses stipend
• Earn a trip anywhere in the world every 4 years
• R$1.035/month for meals allowance
• Health plan with national coverage and without coparticipation
• Dental Insurance: we help you with dental treatment for a better quality of life.
• Wellhub Membership: Access a wide range of gyms and training programs.