M
Security Compliance Analyst
Contract type
Ongoing
Work mode
Remote · Colombia
Experience
3 years
Job description
Security Compliance Analyst at Masabi, responsible for running assigned security control processes end to end, third-party risk activities, and supporting customer security questionnaires and audits. The role is fully remote for candidates based in Colombia.
At a glance
- Employment
- Full-time · Employee (employment agreement)
- Work mode
- Remote · Colombia
What you'll do
- Own a set of assigned security control processes end to end: plan them, carry them out, gather evidence, and track findings until they're resolved with clear ownership
- Perform manual and tool-based security controls, helping close gaps where controls are missing or not run consistently
- Carry out regular reviews, such as user access reviews, and make sure results and actions are recorded
- Run day-to-day Third-Party Risk Management (TPRM) activities: assessing new and existing suppliers, reviewing their security posture, tracking risks and scheduling reassessments
- Keep security and privacy registers (supplier, risk, asset and data processing) accurate and current
- Help analyse security and privacy requirements in bids and tenders from transport agencies, working with the wider team to prepare clear, accurate answers
- Respond to security questionnaires and information requests from existing customers
- Support audits and certifications (such as ISO 27001, ISO 27017/27018, AICPA SOC 2, PCI DSS, NIST CSF and Cyber Essentials) by preparing evidence and documentation
- Spot opportunities to automate or improve control processes, including with AI tools, and help put them in place
What we're looking for
- Hands-on experience in information security, IT compliance, internal control or audit, including running control processes yourself rather than only supporting others
- Practical experience preparing evidence for audits or assessments against at least one recognised framework, such as ISO 27001, SOC 2, PCI DSS or NIST
- A working understanding of access control, risk management, third-party risk and data protection
- Detail-oriented and consistent: you follow a process carefully and don't let things slip through the cracks
- Organised enough to juggle several recurring tasks and deadlines at once
- Curious about technology, with a habit of learning how systems, cloud services and SaaS tools fit together
- Clear writing and a knack for structuring information, whether that's documentation, registers or questionnaire answers
- Comfortable taking ownership of your work, and not afraid to ask questions when something isn't clear
Nice to have
- Experience with Third-Party Risk Management or vendor security assessments
- Knowledge of frameworks such as ISO 27001, SOC 2, PCI DSS, GDPR or NIST, and experience mapping controls across them
- Experience supporting RFPs, tenders or customer security questionnaires
- Hands-on experience with compliance automation or GRC platforms (for control monitoring, evidence collection and audit management)
- Interest in automation, such as scripting, low-code tools (e.g. n8n, Make) or using AI to improve workflows
- Experience with Vanta, AWS, Jira or Confluence
- A relevant certification such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC, CISSP or Security+
- Experience in SaaS, payments, public transport or public sector environments
Your team
Security team
Masabi builds Justride, a mobile ticketing and fare collection platform used by public transport authorities and agencies around the world; security and compliance are central to the business.
Benefits
- 15 days paid vacation per year plus 18 public holidays
- Private Healthcare
- Monthly team bonding allowance
- Menopause support
- Choice of a workstation
- Ability to work for up to 3 months per year from any country in the world
- Fun and collaborative environment with a focus on making a difference in the world
- Training allowance of up to $750 USD and $250 USD to spend on your home office every year
Apply
About Masabi
We're driving the fare payment revolution, powering the journeys of millions all over the world.
Masabi builds fare collection platforms that allow riders to seamlessly buy and present tickets for public transport either on their mobile phones, from a ticket machine, or even by tapping their bank card to travel.
Mission
Driven by a mission to make transit fair and accessible for all.
Key facts
- Fare collection and mobile ticketing for public transport
- Justride platform is used in over 250 locations globally, including some of the largest cities in the world
- Industry-first mobile ticketing SDK
- Partners with large players in the transport space
Partners & customers
UberMoovitTransit
What they value
- Driven by Purpose
- Encouraged to Accelerate
- Advancing with Empathy