Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 6 hours agoWe saw it 58 min after it went up

GRC Engineer

Tractian66 open roles

Where
São Paulo, SP
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowGRC EngineerTractian · São Paulo, SP

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Tractian's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.9% of postings close within 7 days. Measured by our own scanner across the market. Tractian postings stay open a median of 3 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 12.9%7 days
  4. 21.0%14 days
  5. 35.6%30 days
  6. 58.5%60 days
This job: posted 6 hours ago

Tractian median: 3 days open

The posting

GRC Engineer

As a GRC Engineer, you will be part of our Governance, Risk, and Compliance (GRC) team, contributing to the development, implementation, and continuous improvement of our security governance, risk management, and compliance programs. You will collaborate with technical and business teams to strengthen security controls, manage risks, and support compliance with industry standards. We are looking for an experienced, hands-on, and versatile professional with strong GRC expertise and a technical mindset. You will work alongside the team to drive initiatives across multiple GRC domains, leveraging Artificial Intelligence (AI), automation, and emerging technologies to build scalable and efficient processes.

Key Responsibilities • Develop, implement, and continuously improve information security governance, risk management, compliance, and assurance processes. • Support compliance with frameworks and standards such as ISO 27001, ISO 27002, SOC 2, and other applicable requirements. • Conduct risk assessments, evaluate security controls, maintain risk registers, and coordinate risk treatment and remediation activities. • Support internal and external audits, certification processes, evidence collection, and continuous compliance monitoring. • Develop and maintain security policies, standards, procedures, and governance documentation. • Improve Business Continuity Management (BCM), Disaster Recovery (DR), Incident Response (IR), and Third-Party Risk Management (TPRM) activities, including gap analysis, planning, exercises, and testing. • Assess secure software development practices and collaborate with Engineering teams to integrate security and compliance requirements into the Software Development Lifecycle (SDLC). • Conduct customer security and compliance due diligence, including security questionnaires, RFPs, and contractual security assessments. • Identify and implement opportunities to automate GRC processes using AI, APIs, integrations, and other technologies. • Collaborate with Engineering, Infrastructure, Security, Product, and business teams to integrate security and compliance requirements into operational and technical processes.

Requirements • Background in Information Technology, Information Security, GRC, Internal Audit, Compliance, or related fields. • Proven hands-on experience implementing or improving information security governance, risk management, and compliance programs. • Experience with ISO 27001 / ISO 27002, SOC 2, or equivalent security frameworks. • Proven hands-on experience in Information Security Risk Management, including risk assessments, risk treatment, control evaluation, and remediation management. • Practical experience implementing or maintaining Business Continuity Management (BCM) and Disaster Recovery (DR) processes, including BIA, RTO/RPO, recovery planning, and testing. • Hands-on experience with Incident Response (IR) processes, including incident management, response procedures, exercises, and post-incident improvement. • Experience conducting Third-Party Risk Management (TPRM) assessments, evaluating vendor security controls, and managing associated risks. • Knowledge of data protection and privacy requirements, including LGPD and GDPR. • Understanding of assessing Secure Software Development practices, including SDLC security controls, code review processes, vulnerability management, etc. • Understanding of cloud infrastructure concepts, identity and access management, and cybersecurity concepts. • Experience supporting internal or external audits, compliance assessments, and evidence management. • Ability to independently assess risks, evaluate controls, and drive improvements across different GRC domains. • Ability to leverage AI, automation tools to improve workflows, solve problems, and increase operational efficiency. • Advanced Portuguese and English proficiency.

Nice to Have • Experience with GRC platforms (e.g., Vanta, Drata). • Experience with Policy-as-Code or Compliance-as-Code • Familiarity with cloud environments (AWS, OCI, GCP), Infrastructure as Code (IaC), CI/CD pipelines, and Git-based workflows. • Experience building AI-assisted workflows or using LLMs and AI agents to automate GRC activities. • Knowledge of additional frameworks such as ISO 22301, ISO 27701, ISO 42001, NIST CSF, or FedRAMP. • Market-recognized security, risk management, or compliance certifications.

Compensation & Benefits Competitive Compensation 30 days of paid annual leave Education and courses stipend Earn a trip anywhere in the world every 4 years R$1.035/month for meals allowance Health plan with national coverage and without coparticipation Dental Insurance: we help you with dental treatment for a better quality of life. Wellhub Membership: Access a wide range of gyms and training programs.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Tractian's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Tractian's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Tractian's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.