At a glance
- Employment
- Full-time
- Workplace
- Remote
- Location
- Colombia
About the role
- You will join the Security team at Masabi to help run security controls consistently and on time.
- As a Security Compliance Analyst, you will own assigned control processes end-to-end, carry out reviews, run third-party risk activities, and support commercial teams with customer security inquiries.
Responsibilities
- Own a set of assigned security control processes end to end: plan them, carry them out, gather evidence, and track findings until they’re resolved with clear ownership.
- Perform manual and tool-based security controls, helping us close gaps where controls are missing or not run consistently.
- Carry out regular reviews, such as user access reviews, and make sure results and actions are recorded.
- Run day-to-day Third-Party Risk Management (TPRM) activities: assessing new and existing suppliers, reviewing their security posture, tracking risks and scheduling reassessments.
- Keep our security and privacy registers (supplier, risk, asset and data processing) accurate and current.
- Help analyse security and privacy requirements in bids and tenders from transport agencies, working with the wider team to prepare clear, accurate answers.
- Respond to security questionnaires and information requests from existing customers.
- Support audits and certifications (such as ISO 27001, ISO 27017/27018, AICPA SOC 2, PCI DSS, NIST CSF and Cyber Essentials) by preparing evidence and documentation.
- Spot opportunities to automate or improve control processes, including with AI tools, and help put them in place.
Requirements
- Hands-on experience in information security, IT compliance, internal control or audit, including running control processes yourself rather than only supporting others.
- Practical experience preparing evidence for audits or assessments against at least one recognised framework, such as ISO 27001, SOC 2, PCI DSS or NIST.
- A working understanding of access control, risk management, third-party risk and data protection.
- Detail-oriented and consistent: you follow a process carefully and don’t let things slip through the cracks.
- Organised enough to juggle several recurring tasks and deadlines at once.
- Curious about technology, with a habit of learning how systems, cloud services and SaaS tools fit together.
- Clear writing and a knack for structuring information, whether that’s documentation, registers or questionnaire answers.
- Comfortable taking ownership of your work, and not afraid to ask questions when something isn’t clear.
Preferred qualifications
- Experience with Third-Party Risk Management or vendor security assessments.
- Knowledge of frameworks such as ISO 27001, SOC 2, PCI DSS, GDPR or NIST, and experience mapping controls across them.
- Experience supporting RFPs, tenders or customer security questionnaires.
- Hands-on experience with compliance automation or GRC platforms (for control monitoring, evidence collection and audit management).
- Interest in automation, such as scripting, low-code tools (e.g. n8n, Make) or using AI to improve workflows.
- Experience with Vanta, AWS, Jira or Confluence.
- A relevant certification such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC, CISSP or Security+.
- Experience in SaaS, payments, public transport or public sector environments.
Benefits
- 15 days paid vacation per year plus 18 public holidays
- Private Healthcare
- Monthly team bonding allowance
- Menopause support
- Choice of a workstation
- Ability to work for up to 3 months per year from any country in the world
- Fun and collaborative environment with a focus on making a difference in the world
- Training allowance of up to $750 USD per year
- $250 USD to spend on your home office every year
Workplace
- This role is only available to candidates based in Colombia in a fully remote model.
Skills
- Vanta
- AWS
- Jira
- Confluence
- N8n
- Make
- ISO 27001
- SOC 2
- PCI DSS
- GDPR
- NIST
