CyberSecurity Manager

Company Overview:

 

Global Technology Services is a rapidly expanding organization situated in Medellín, Colombia. We pride ourselves on possessing one of the most influential networks within software development and IT services for the entertainment, financial, and logistics sectors. Our corporate projections offer a multitude of opportunities for professionals to elevate their careers and experience substantial growth. Joining our team means engaging with expansive engineering teams across Latin America, Philippines and the United States, contributing to cutting-edge developments in multiple industries.

 

Position Title: CyberSecurity Manager

Category: Cybersecurity & Risk Management

Seniority: Senior

Location: LATAM (Colombia Preferred)

 

What you will be doing:

You will be the first dedicated security hire and the single owner of our security posture. Nobody else is going to do this for you, and nobody else is going to do it for you, you set the program, you run it, you maintain compliance, you’re accountable for it.

Your first-year headline objective: get the company to a clean SOC 2 Type II certification report. Everything else supports that or protects the company while you do it. Once certification is achieved, you will be fully responsible for always maintaining it.

This is a hands-on role. You will write Terraform, tune AWS security controls, build policies, run tabletops, enforce personnel compliance, chase evidence, and sit on customer security calls — often in the same week. If you want a role where you manage a team and review dashboards, this isn’t it yet. If you want to build a real security program from scratch and own the outcome, it is.

Key Responsibilities. 

 

SOC 2 certification (the priority)

• Define scope and trust services criteria; run the readiness/gap assessment

• Close control gaps across engineering, AWS Cloud, IT, HR, and operations

• Select and manage the audit firm; own the relationship and timeline

• Drive Type I, then manage the observation window through to Type II

• Build the program so year-two renewal is routine, not a fire drill 

 

Drata

• Full ownership as administrator: control mapping, monitoring coverage, and evidence automation

• Policy lifecycle — author, version, publish, and enforce annual attestation

• Personnel onboarding/offboarding controls, enforcing personnel compliance, access reviews, and background check tracking

• Vendor and risk registers kept genuinely current, not backfilled the week before an audit

 

AWS cloud security

• IAM least privilege, role hygiene, and elimination of long-lived credentials

• AWS Organizations, SCPs, and account separation between environments

• GuardDuty, Security Hub, Config, CloudTrail, and centralized log retention

• Encryption at rest and in transit; KMS key management and rotation

• VPC design, network segmentation, security group review, WAF

• Secrets management, S3 and RDS access controls, and public-exposure prevention

• Backup, restore testing, and disaster recovery with defined RTO/RPO

• Patch and vulnerability management with remediation SLAs that are actually met

 

Application security (with Engineering)

• Owning Aikido for repository scanning and vulnerability resolution with engineering

• Bi-annual pentesting with Aikido

• Embed SAST, DAST, dependency, and IaC scanning into CI/CD

• Secure SDLC standards, security review of designs, and developer guardrails

• Coordinate annual penetration testing and drive remediation to closure

• Audit logging and monitoring of PHI access inside our products

HIPAA and healthcare-specific compliance

• Serve as our designated HIPAA Security Official

• Maintain the HIPAA Security Rule risk analysis and risk management plan

• BAA governance in both directions — customers and subprocessors

• 42 CFR Part 2 controls for substance use disorder records

• Breach assessment and notification procedures, with defined timelines

• Track applicable state privacy laws affecting our customer base

 

Identity, endpoints, and internal IT security

• SSO and enforced MFA across all business systems

• MDM, disk encryption, and endpoint protection on every company device

• Quarterly access reviews and least-privilege enforcement on internal tools

 

Physical security

• Office access control, visitor procedures, and badge/key management

• Camera coverage, clean desk standards, and secure device and document disposal

• Remote and home-office security standards for our distributed staff

• Document inherited AWS data center controls for audit purposes

 

Incident response

• Write and maintain the IR plan; define severity levels and escalation paths

• Run tabletop exercises at least semiannually, including a ransomware and a PHI-exposure scenario

• Lead investigations and post-incident reviews

 

Security awareness and customer trust

• Annual training plus ongoing phishing simulations, with completion enforcement

• Own security questionnaires, RFP responses, and customer security calls — fast turnaround here directly wins deals

• Maintain our public trust page and customer-facing security documentation

Required Skills & Experience

 

• 5 – 7 years in security, with meaningful hands-on ownership rather than pure oversight

• Degree in computer science or related field. 

• Deep, practical AWS security experience in a production environment

• You have taken at least one compliance audit (SOC 2, ISO 27001, HITRUST, or similar) from gap assessment through to issued report

• Working knowledge of HIPAA and handling PHI in a SaaS environment

• Comfort in infrastructure as code (Terraform preferred) and scripting to automate controls

• Ability to write clearly — policies, customer responses, and executive updates all land on your desk

• Judgment about risk. You can tell a real threat from an audit artifact and prioritize accordingly

 

Nice to Have Skills

 

• CISSP, CCSP, AWS Certified Security – Specialty, CISA, or equivalent

• Healthcare or behavioral health SaaS background

• Familiarity with 42 CFR Part 2 or HITRUST

• Prior experience as a first security hire at a growing company

 

Soft Skills

 

• Strong problem-solving and debugging skills

• Ability to work independently and take ownership of projects

• Strong communication skills with the ability to articulate, diagram and document complex engineering concepts.

Why you will love GTS:

• Join a powerful tech workforce and help us change the world through technology

• Professional development opportunities with international customers

• Collaborative work environment

• Career path and mentorship programs that will lead to new levels.

Join GTS and contribute to shaping the data landscape within a dynamic and growing organization. Your skills will be honed, and your contributions will play a vital role in our continued success. GTS is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.