Security Compliance Engineer

Accountabilities:

• Contribute to security audits and certification processes, including ISO 27001, ISO 27701, ISO 42001, SOC 2, and PCI DSS, providing technical expertise and implementation support.
• Translate security, compliance, and privacy requirements into scalable technical controls that are enforceable, measurable, and auditable.
• Collaborate with Engineering and DevOps teams to implement, maintain, and validate cloud security controls across AWS and GCP environments.
• Develop and maintain internal security tools using Python to automate security processes, improve operational efficiency, and strengthen technical safeguards.
• Support the implementation and continuous improvement of cloud security measures, including web application firewalls, threat detection, security monitoring, and cloud security posture management.
• Help ensure that technical configurations, security processes, and supporting evidence meet applicable audit requirements and industry standards.
• Contribute to privacy-focused initiatives by helping integrate data protection principles and privacy requirements into technical systems and operational workflows.
• Support security risk management activities, including vendor risk assessments and third-party security reviews where required.
• Work cross-functionally to identify control gaps, recommend remediation measures, and promote security and compliance best practices throughout the organization.
• Stay informed about emerging technologies, cloud security developments, and evolving regulatory requirements relevant to payments and financial technology.

Requirements:

• Practical experience supporting ISO audits and translating compliance requirements into effective technical implementations.
• Previous experience in fintech, payments, financial services, or another highly regulated environment.
• Familiarity with SOC 2 and/or PCI DSS frameworks, particularly their technical implementation and application to engineering environments.
• Understanding of information security, privacy principles, data protection requirements, and relevant compliance frameworks.
• Working knowledge of Python, with the ability to develop, maintain, and improve scripts or lightweight security tools.
• Solid knowledge of AWS and/or GCP security services, including capabilities such as web application firewalls, threat detection, security monitoring, and security posture management.
• Strong collaboration and communication skills, with the ability to work effectively with technical teams and translate compliance requirements into practical engineering solutions.
• Fluency in English, both written and spoken, to support collaboration across distributed teams and international stakeholders.
• Familiarity with Kubernetes and container security is an advantage.
• Experience with infrastructure as code tools, such as Terraform or CloudFormation, is desirable.
• Knowledge of vendor risk management processes and third-party security assessments is a plus.
• Familiarity with modern architectures, including serverless applications, event-driven systems, and AI integrations, is beneficial.
• A proactive, detail-oriented approach to problem-solving, with a strong sense of ownership and a commitment to maintaining robust security and compliance standards.