Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 18 days ago

Internal Audit & Compliance Manager ( Remote in Colombia )

otonomee3 open roles

Where
Colombia
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowInternal Audit & Compliance Manager ( Remote in Colombia )otonomee · Colombia

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on otonomee's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

7.8% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 1.7%1 day
  2. 3.5%3 days
  3. 7.8%7 days
  4. 14.6%14 days
  5. 34.0%30 days
This job: posted 18 days ago

The posting

About The Role

We are seeking an experienced Internal Audit & Compliance Manager to own the day-to-day operation of Otonomee’s governance, risk and compliance programmes. This role will be central to maintaining a strong, scalable control environment as the business continues to grow and expand its technology, data and AI capabilities.

The successful candidate will manage our established ISO/IEC 27001 ISMS, maintain continuous audit readiness across PCI DSS and SOC 2, and support additional frameworks on our roadmap. The role will establish a risk-based internal audit programme, coordinate internal and external audits, operate the GRC platform, and ensure that controls, policies, risks, findings and supporting evidence are actively managed.

Working across technology, operations and corporate functions, the role will translate compliance requirements into practical controls and provide clear, objective assurance to senior leadership. It will also support client assurance through security questionnaires, RFP responses, vendor reviews and compliance reporting.

Success will be measured through sustained certification and attestation outcomes, effective control operation, timely remediation of findings and improved visibility of organisational risk. This is a high-impact opportunity for an experienced compliance professional who combines independent judgement with a pragmatic understanding of a fast-growing international business.

Reporting Line

The role reports to the CTO for security programme delivery and technical oversight, with an independent assurance line to the CEO.

What you will do

  • Establish and run a planned internal audit programme across ISO 27001, PCI DSS, SOC 2, and additional frameworks in scope (e.g. HIPAA, HITRUST), including control testing, findings, and remediation tracking to closure.
  • Provide independent assurance to the CTO, CEO, and senior leadership on control effectiveness and compliance status.
  • Maintain continuous audit readiness and coordinate external audits and certification cycles end to end, acting as the primary point of contact for auditors.
  • Conduct risk assessments using risk-based methodologies; develop and track key risk indicators (KRIs) and mitigation plans.
  • Liaise with business process owners and technical teams to drive and track remediation of control gaps and audit findings.
  • Advise stakeholders and leadership on compliance gaps, risks, and their business impact, recommending pragmatic mitigations.
  • Prepare and present compliance reports for internal stakeholders (leadership and board) and external parties (auditors, clients, and regulators).
  • Run third-party and vendor risk reviews and ongoing monitoring.
  • Own security questionnaires and RFP compliance responses, and support client-facing assurance (Trust Centre).
  • Lead information-security awareness initiatives and strengthen the organisation's compliance culture.
  • Act as ISMS Coordinator, owning the day-to-day operation and continuous improvement of the ISO/IEC 27001 Information Security Management System, and safeguarding the confidentiality, integrity, and availability of company and client information as the programme's central objective.
  • Operate and administer the Drata GRC platform: integrations, control mapping, automated evidence collection, alerts, and the policy centre.
  • Cross-map controls across ISO 27001, SOC 2, PCI DSS, and additional frameworks to eliminate duplicated effort, and manage the roadmap for frameworks in pursuit (HIPAA, HITRUST, and any further standards adopted).
  • Own the SOC 2 programme against the Trust Services Criteria (security, availability, confidentiality, processing integrity, and privacy), maintaining evidence and control operation to an audit-grade standard.
  • Maintain the policy and procedure lifecycle: drafting, version control, review cadence, and employee acknowledgements.
  • Manage audit evidence and compliance documentation so that control operation is demonstrable at any point in the audit period.
  • As owner of the ISMS and compliance programme, uphold and enforce Otonomee's information security policies, lead the organisation's security-awareness and compliance culture, and ensure security incidents and control weaknesses are managed, escalated, and remediated to closure.

Your profile

Requirements & Experience

  • Proven experience (typically 8+ years) in internal audit, GRC, or information-security compliance, including in regulated environments.
  • Hands-on experience implementing and operating an ISO/IEC 27001 ISMS, including gap assessments and remediation roadmaps.
  • Working knowledge of SOC 2 and its Trust Services Criteria, with practical evidence and control-operation experience or a clear trajectory towards it.
  • Practical PCI DSS compliance experience: evidence validation, control documentation, and audit follow-up.
  • Demonstrated internal audit capability, ideally with a recognised internal-auditor qualification.
  • Experience with a GRC or compliance-automation platform (e.g. Drata or equivalent).
  • Strong command of risk-based methodologies, KRIs, control-effectiveness evaluation, and evidence management.
  • Experience working remotely with distributed, cross-functional teams in a global environment.
  • Data-protection / privacy experience (e.g. GDPR or equivalent) and awareness of financial-crime / AML-CTF contexts desirable.
  • Exposure to HIPAA, HITRUST, NIST CSF/RMF, or other security and healthcare frameworks desirable.

Key Competencies

  • Act as the single accountable owner of a cross-framework compliance programme.
  • Exercise objective, independent judgement and provide candid assurance.
  • Communicate compliance status clearly to leadership, auditors, and clients.
  • Translate framework requirements into practical, operational controls.
  • Balance control rigour with the pace and realities of a growing operation.
  • Be detail-oriented, evidence-driven, and methodical.
  • Quickly familiarise yourself with new compliance frameworks as they are adopted.
  • Proactively upskill and stay current with evolving regulations, controls, and audit expectations.

Why us?

  • Fully work from home role based in Colombia
  • A competitive salary
  • Benefits
  • Equipment provided
  • Home office allowance
  • Online Gym and Wellbeing Studio
  • The opportunity for professional growth
  • Fun company events and team outings
  • Autonomy and Responsibility

OUR RECRUITMENT PROCESS

  1. 45 min Teams interview with the Recruitment Team
  2. Language test if applicable to the role
  3. Technical test
  4. 45 min Teams interview with the Hiring Team

OTO1

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against otonomee's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on otonomee's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    otonomee's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.