Senior SecOps & PrivacyOps Engineer

Contractor · Remote in LATAM · Full-time · Long-term · US business hours overlap

Our client, a U.S. healthcare technology company, is building a multi-tenant healthcare AI platform and is actively pursuing ISO 27001, ISO 27017, ISO 27018, and Cyber Essentials Plus certifications alongside its existing SOC 2 and HIPAA posture.

We are looking for a hands-on SecOps & PrivacyOps Engineer to execute the day-to-day security, privacy, and AI-governance work that keeps the company audit-ready and reduces its dependency on external compliance vendors over time. Reporting directly to the Director who leads security, privacy, DevOps, and IT operations, you will own recurring operational security and privacy duties across both traditional SaaS infrastructure and AI/LLM-based product workflows.

This is an execution-focused, senior individual contributor role, not a platform-leadership or people-management position. Platform strategy and direction are already owned by the Director; we need someone who does the work directly: setting security strategy, running tools, gathering evidence, closing findings, and keeping controls current.

Responsibilities

Data Privacy, Compliance, Retention & Regulatory: Maintain ongoing compliance with GDPR, ISO 27001/27017/27018, Cyber Essentials Plus, HIPAA, and the EU AI Act; manage data retention schedules, subject-access requests, and regulatory reporting.
Data Access Management, Data Protection, Ransomware Protection & DR: Administer IAM and periodic access reviews, encryption and key-management controls, ransomware defense, and disaster-recovery testing.
Data Processing & Transfer Standards: Maintain Data Processing Agreements, cross-border transfer mechanisms (SCCs, data residency commitments), and sub-processor/vendor governance.
Data Loss Prevention (DLP) & CASB: Implement and manage DLP policies and cloud access security broker tooling across SaaS and cloud environments.
Data Governance: Own data discovery, classification, tagging, lineage, stewardship, and lifecycle management across the data estate.
AI Governance: Manage AI-specific risk controls, including prompt-injection and data-poisoning protection, model governance, and AI residency/regulatory compliance (EU AI Act, NIST AI RMF, ISO/IEC 42001).
Certification Maintenance: Own continuous security monitoring, policy upkeep, and preparation for ISO surveillance audits and the annual Cyber Essentials reassessment, reducing reliance on external compliance vendors for these recurring activities over time.

Requirements

Approximately 5–8 years of individual-contributor experience in security, privacy, or compliance engineering (senior IC level, not a Head-of or Director-level profile).
Hands-on experience securing both traditional SaaS platforms and AI/LLM-based workflows, with real technical depth beyond policy or GRC tooling.
Practical, working-level exposure to ISO 27001/27017/27018, SOC 2, GDPR, Cyber Essentials Plus, and HIPAA; having personally supported an audit cycle is strongly preferred over classroom or certification-only knowledge.
Working familiarity with cloud security tooling in an AWS-native environment: IAM, KMS, CloudTrail, GuardDuty, and cloud security posture management (CSPM) tools.
Experience with DLP and CASB platforms, as well as SIEM/log-monitoring tooling.
Understanding of AI-specific security and governance risks: prompt injection, data poisoning, and model governance frameworks (NIST AI RMF, ISO/IEC 42001).
Based in Latin America, with availability to overlap working hours with the US-based leadership team.

Nice to Have

Prior experience at a healthcare, health tech, or regulated-industry SaaS company.
Direct experience supporting an ISO 27001 or Cyber Essentials Plus certification audit from the customer/implementer side.
Familiarity with Secureframe or a comparable GRC/evidence-management platform, such as ServiceNow GRC.
Experience with data and AI governance tools such as Trust3 AI, BigID, PlainID, or Satori.

What We Offer

Competitive USD Compensation — Get paid in USD.
100% Remote Work — Work from anywhere in Latin America.
Equipment Provided — We provide the equipment you need to do your best work.
Paid Time Off — Enjoy 12 PTO days per year to rest, recharge, and take time for yourself.
Local Public Holidays — Celebrate all official holidays in your country.
Birthday Off — Enjoy your special day, on us!
Career Growth Opportunities — Keep learning, developing your skills, and advancing your career.
Recognition Program — Your contributions matter, and we make an effort to celebrate them.
Paid Approved Leaves — Receive paid leave for eligible, approved absences, in accordance with company policies.