STAFFY For people. For companies.
Back to jobs

New opportunity

Senior GRC – Cyber Risk, Compliance & Security Automation

Remoto Remoto Senior

About the company

We are a young and fast-growing recruiting company with five years of experience working across Latin America and the United States. We partner closely with teams and founders to help them build strong, high-impact teams through recruitment, outsourcing, and team-building services.

Our culture is built on effective communication, trust, and transparency. We believe great work happens when people feel heard, supported, and empowered to grow. Today, our team is made up of more than 80 professionals working across different projects throughout the region, collaborating remotely and learning from each other every day.

About the role

We are looking for a Senior GRC Professional to join a cybersecurity and compliance team operating in a highly regulated, critical-infrastructure environment spanning digital assets, energy, and high-performance computing.

This is a hands-on role combining ISO 27001 and SOC 2 compliance, cybersecurity risk management, third-party risk, M&A security due diligence, and compliance engineering.

You will be responsible for implementing and maintaining security controls, supporting certification and audit processes, managing cybersecurity risks, and developing automated solutions for compliance evidence collection and testing.

A key priority will be preparing the organization for ISO 27001 Stage 1 and SOC 2 Type I, ensuring controls are properly designed, documented, and audit-ready. You will also support ISO 27001 Stage 2 and SOC 2 Type II, validating control effectiveness over the required observation periods.

Beyond traditional GRC activities, this role requires technical expertise to integrate compliance platforms with cloud and identity systems, automate evidence collection, and collaborate directly with IT and Engineering teams to resolve control gaps.

We are looking for someone who combines strong knowledge of security and compliance frameworks with technical problem-solving skills, attention to detail, and the ability to independently execute complex initiatives.

Responsibilities

  • Compliance & Certification
  • Operate and maintain the ISO 27001:2022 Information Security Management System (ISMS), including scope definition, risk methodology, Statement of Applicability, internal audits, management reviews, corrective actions, and surveillance activities.
  • Support and coordinate ISO 27001 Stage 1 and Stage 2 certification activities, ensuring controls are documented, implemented, and tested.
  • Lead SOC 2 Type I and Type II activities, including scoping, control mapping, evidence collection, and auditor walkthroughs.
  • Act as a primary point of contact for external auditors, coordinating requests and addressing audit findings.
  • Maintain a unified control framework mapped across multiple security and compliance standards.
  • Identify readiness gaps, coordinate remediation, and maintain audit-ready documentation.
  • Cyber Risk Management
  • Manage cybersecurity risk registers, risk assessments, treatment plans, risk-owner acceptance, and reporting.
  • Apply recognized risk methodologies such as NIST IR 8286, ISO 27005, or FAIR.
  • Collaborate with technical and business stakeholders to assess risk exposure and prioritize remediation activities.
  • Prepare risk reports and communicate findings and recommendations to leadership.
  • Third-Party & Supply Chain Risk
  • Manage the third-party risk lifecycle, including vendor intake, risk classification, assessments, exceptions, continuous monitoring, and offboarding.
  • Review vendor security documentation, including SOC 2 reports, ISO certifications, security questionnaires, and penetration testing summaries.
  • Identify vendor security risks and coordinate remediation through closure.
  • Extend third-party risk assessments to Software Bills of Materials (SBOMs), SaaS providers, and AI-related vendors.
  • M&A Security & Regulatory Compliance
  • Participate in and lead cybersecurity due diligence activities for mergers and acquisitions, evaluating security controls, data exposure, compliance gaps, remediation requirements, and integration costs.
  • Support Day 1 and 100-day post-acquisition security integration planning.
  • Maintain repeatable security due diligence processes and documentation.
  • Support regulatory compliance activities involving standards such as NERC CIP, collaborating with Engineering teams responsible for technical controls.
  • Compliance Engineering & Evidence Automation
  • Design, build, and maintain automated evidence collection and control testing workflows using GRC platforms, workflow tools, and cloud, identity, and SaaS APIs.
  • Develop scripts and technical integrations using technologies such as Python and REST APIs.
  • Integrate GRC platforms with cloud environments, including AWS or Azure, and identity management systems.
  • Establish runbooks, error handling, and repeatable processes for evidence collection and control validation.
  • Collaborate with IT and Engineering teams to resolve control gaps, document exceptions, and track remediation activities.
  • Identify opportunities to improve compliance efficiency through automation and technical integrations.
  • Policy Management & Reporting
  • Manage the complete policy lifecycle, including drafting, review, approval, publication, and employee attestation.
  • Maintain accurate compliance documentation, audit narratives, risk assessments, and control evidence.
  • Prepare reports on compliance status, cybersecurity risk posture, and audit readiness.
  • Communicate findings, risks, and remediation progress to technical teams and executive stakeholders.

Requirements

  • 6+ years of experience in Security GRC, Compliance Engineering, or a related cybersecurity discipline.
  • Hands-on experience operating an ISO 27001:2022 ISMS through a certification or surveillance audit.
  • Experience supporting SOC 2 Type II audits, including evidence collection, control testing, and auditor coordination.
  • Strong knowledge of cybersecurity risk management, including risk registers, assessments, and treatment plans using recognized methodologies.
  • Experience managing third-party security risk assessments and continuous monitoring.
  • Technical experience with scripting or programming, REST APIs, and automated evidence collection.
  • Experience extracting security and compliance evidence from AWS or Azure environments and identity platforms.
  • Hands-on experience with GRC and compliance automation platforms, such as Drata, Vanta, Secureframe, or equivalent solutions.
  • Strong written communication skills, including the ability to prepare policies, audit narratives, risk assessments, and documented risk decisions.
  • Ability to collaborate with IT, Engineering, and business stakeholders to resolve compliance gaps and implement security controls.
  • Strong analytical thinking, attention to detail, and ability to independently manage technical compliance initiatives.
  • At least one relevant certification: ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CRISC, CISM, or CISSP.

Nice to have

  • Experience with M&A cybersecurity due diligence or post-merger security integration.
  • Background in digital assets, energy, data centers, high-performance computing, or critical infrastructure.
  • Knowledge of NERC CIP, IEC 62443, or other operational technology security standards.
  • Experience with workflow automation tools and API-driven compliance evidence pipelines.
  • Familiarity with AI governance frameworks, including ISO 42001 and NIST AI Risk Management Framework.

Benefits

  • People First culture
  • Referral Program
  • Free access to streaming platforms
  • Free access to Spotify Premium
  • GYM discount
  • Travel discount
  • E-Learning discount
  • Birthday-day gift
  • Points Program