GRC Engineer

As a GRC Engineer, you will be part of our Governance, Risk, and Compliance (GRC) team, contributing to the development, implementation, and continuous improvement of our security governance, risk management, and compliance programs. You will collaborate with technical and business teams to strengthen security controls, manage risks, and support compliance with industry standards. We are looking for an experienced, hands-on, and versatile professional with strong GRC expertise and a technical mindset. You will work alongside the team to drive initiatives across multiple GRC domains, leveraging Artificial Intelligence (AI), automation, and emerging technologies to build scalable and efficient processes.

Key Responsibilities

• Develop, implement, and continuously improve information security governance, risk management, compliance, and assurance processes.

• Support compliance with frameworks and standards such as ISO 27001, ISO 27002, SOC 2, and other applicable requirements.

• Conduct risk assessments, evaluate security controls, maintain risk registers, and coordinate risk treatment and remediation activities.

• Support internal and external audits, certification processes, evidence collection, and continuous compliance monitoring.

• Develop and maintain security policies, standards, procedures, and governance documentation.

• Improve Business Continuity Management (BCM), Disaster Recovery (DR), Incident Response (IR), and Third-Party Risk Management (TPRM) activities, including gap analysis, planning, exercises, and testing.

• Assess secure software development practices and collaborate with Engineering teams to integrate security and compliance requirements into the Software Development Lifecycle (SDLC).

• Conduct customer security and compliance due diligence, including security questionnaires, RFPs, and contractual security assessments.

• Identify and implement opportunities to automate GRC processes using AI, APIs, integrations, and other technologies.

• Collaborate with Engineering, Infrastructure, Security, Product, and business teams to integrate security and compliance requirements into operational and technical processes.

Requirements

• Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or related fields.

• Proven hands-on experience implementing or improving information security governance, risk management, and compliance programs.

• Experience with ISO 27001 / ISO 27002, SOC 2, or equivalent security frameworks.

• Proven hands-on experience in Information Security Risk Management, including risk assessments, risk treatment, control evaluation, and remediation management.

• Practical experience implementing or maintaining Business Continuity Management (BCM) and Disaster Recovery (DR) processes, including BIA, RTO/RPO, recovery planning, and testing.

• Hands-on experience with Incident Response (IR) processes, including incident management, response procedures, exercises, and post-incident improvement.

• Experience conducting Third-Party Risk Management (TPRM) assessments, evaluating vendor security controls, and managing associated risks.

• Knowledge of data protection and privacy requirements, including LGPD and GDPR.

• Understanding of assessing Secure Software Development practices, including SDLC security controls, code review processes, vulnerability management, etc.

• Understanding of cloud infrastructure concepts, identity and access management, and cybersecurity concepts.

• Experience supporting internal or external audits, compliance assessments, and evidence management.

• Ability to independently assess risks, evaluate controls, and drive improvements across different GRC domains.

• Ability to leverage AI, automation tools to improve workflows, solve problems, and increase operational efficiency.

• Advanced Portuguese and English proficiency.

Nice to Have

• Experience with GRC platforms (e.g., Vanta, Drata).

• Experience with Policy-as-Code or Compliance-as-Code

• Familiarity with cloud environments (AWS, OCI, GCP), Infrastructure as Code (IaC), CI/CD pipelines, and Git-based workflows.

• Experience building AI-assisted workflows or using LLMs and AI agents to automate GRC activities.

• Knowledge of additional frameworks such as ISO 22301, ISO 27701, ISO 42001, NIST CSF, or FedRAMP.

• Market-recognized security, risk management, or compliance certifications.