GRC Engineer

TRACTIAN

. Develop, implement, and continuously improve information security governance, risk management, compliance, and assurance processes.

Posted 10/30/2026full-timeRemote • BrazilMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Information Security Governance, Risk Management, and Compliance (GRC) processes, with a strong focus on frameworks such as ISO 27001 and SOC 2. Proficient in Business Continuity Management, Incident Response, and Third-Party Risk Management, while leveraging automation and AI to enhance operational efficiency.

Highest-signal resume keywords

Information Security GovernanceRisk ManagementCompliance ProgramsBusiness Continuity ManagementIncident Response

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

ISO 27001ISO 27002SOC 2Risk AssessmentsControl EvaluationDisaster RecoveryThird-Party Risk ManagementSecure Software DevelopmentData ProtectionCybersecurity Concepts

Soft Skills

Problem SolvingCollaborationIndependent Assessment

Tools & Technologies

AIAutomation ToolsAPIsIntegrations

Industry Keywords

GovernanceRisk ManagementComplianceInternal AuditEvidence ManagementCloud InfrastructureIdentity and Access ManagementGDPRLGPD

Tech Stack

Tools & technologies

CloudCyber SecuritySDLC

About the role

Key responsibilities & impact

Develop, implement, and continuously improve information security governance, risk management, compliance, and assurance processes.
Support compliance with frameworks and standards such as ISO 27001, ISO 27002, SOC 2, and other applicable requirements.
Conduct risk assessments, evaluate security controls, maintain risk registers, and coordinate risk treatment and remediation activities.
Support internal and external audits, certification processes, evidence collection, and continuous compliance monitoring.
Develop and maintain security policies, standards, procedures, and governance documentation.
Improve Business Continuity Management (BCM), Disaster Recovery (DR), Incident Response (IR), and Third-Party Risk Management (TPRM) activities, including gap analysis, planning, exercises, and testing.
Assess secure software development practices and collaborate with Engineering teams to integrate security and compliance requirements into the Software Development Lifecycle (SDLC).
Conduct customer security and compliance due diligence, including security questionnaires, RFPs, and contractual security assessments.
Identify and implement opportunities to automate GRC processes using AI, APIs, integrations, and other technologies.
Collaborate with Engineering, Infrastructure, Security, Product, and business teams to integrate security and compliance requirements into operational and technical processes.

Requirements

What you’ll need

Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or related fields.
Proven hands-on experience implementing or improving information security governance, risk management, and compliance programs.
Experience with ISO 27001 / ISO 27002, SOC 2, or equivalent security frameworks.
Proven hands-on experience in Information Security Risk Management, including risk assessments, risk treatment, control evaluation, and remediation management.
Practical experience implementing or maintaining Business Continuity Management (BCM) and Disaster Recovery (DR) processes, including BIA, RTO/RPO, recovery planning, and testing.
Hands-on experience with Incident Response (IR) processes, including incident management, response procedures, exercises, and post-incident improvement.
Experience conducting Third-Party Risk Management (TPRM) assessments, evaluating vendor security controls, and managing associated risks.
Knowledge of data protection and privacy requirements, including LGPD and GDPR.
Understanding of assessing Secure Software Development practices, including SDLC security controls, code review processes, vulnerability management, etc.
Understanding of cloud infrastructure concepts, identity and access management, and cybersecurity concepts.
Experience supporting internal or external audits, compliance assessments, and evidence management.
Ability to independently assess risks, evaluate controls, and drive improvements across different GRC domains.
Ability to leverage AI, automation tools to improve workflows, solve problems, and increase operational efficiency.
Advanced Portuguese and English proficiency.

Benefits

Comp & perks

Competitive Compensation
30 days of paid annual leave
Education and courses stipend
Earn a trip anywhere in the world every 4 years
R$1.035/month for meals allowance
Health plan with national coverage and without coparticipation
Dental Insurance: we help you with dental treatment for a better quality of life.
Wellhub Membership: Access a wide range of gyms and training programs.