Accountabilities:

Security Governance and Risk Management: Develop, implement, and maintain information security policies, standards, and procedures, including operational guidelines for back-office activities. Maintain the cybersecurity risk register and key indicators, establish third-party risk management policies, and lead monthly Security and Fraud Committee meetings with senior leadership.

Regulatory Compliance and Auditing: Ensure ongoing compliance with Brazil's General Data Protection Law (LGPD), applicable Central Bank regulations, and financial partners' security requirements. Support the Data Protection Officer (DPO), oversee critical access audits, and coordinate internal and external security audits.

Security Awareness and Culture: Design and manage security awareness programs to promote safe behaviors across the organization. Coordinate continuous social engineering simulations and phishing campaigns across email, SMS, and phone channels, strengthening employees' role as the first line of defense.

Incident Response and Third-Party Management: Select, contract, evaluate, and manage external security providers, including 24/7 Security Operations Center (SOC) and Managed Detection and Response (MDR) services, penetration testing consultancies, and SaaS security platforms. Coordinate incident response plans, business continuity plans, and disaster recovery strategies.

Team Leadership and Budget Management: Lead, mentor, and develop the information security team, establishing priorities, objectives, and performance expectations. Prepare and manage the department's budget, covering personnel, tools, and external services.

Security Roadmap and Infrastructure Protection: Oversee the continuous improvement of the organization's security infrastructure, including identity and access management initiatives and the Critical Access Management Program.

Fraud Prevention: Coordinate security and fraud prevention initiatives, considering both transactional and internal fraud risks, and ensure effective collaboration between relevant business and technical stakeholders.

Requirements

Professional Experience: Proven experience in IT governance, information security leadership, and cybersecurity risk management, preferably in financial institutions, fintech companies, credit businesses, or payment service providers.

Security Frameworks: Strong knowledge of recognized security frameworks and best practices, particularly ISO 27001, CIS Controls, and NIST.

Regulatory Knowledge: Practical understanding of LGPD requirements and applicable Central Bank of Brazil regulations concerning cybersecurity, information security, and third-party service contracting.

Business Continuity and Incident Management: Demonstrated experience developing and coordinating Business Continuity Plans (BCP), Incident Response Plans (IRP), and disaster recovery strategies.

Third-Party and SLA Management: Ability to evaluate, negotiate, contract, and audit managed security services, including SOC operations, penetration testing providers, and security awareness platforms.

Leadership Experience: Previous experience managing and developing technical teams, including smaller or specialized teams.

Technical Foundation: Sufficient knowledge of cloud environments, identity and access management, cybersecurity operations, and incident response to guide technical teams and assess external providers.

Fraud Prevention: Understanding of transactional and internal fraud risks, with the ability to coordinate prevention strategies and support security and fraud governance.

Executive Communication: Ability to translate complex technical concepts and cybersecurity risks into clear business impacts and actionable recommendations for senior leadership.

Leadership and Collaboration: Strong interpersonal skills, empathy, and the ability to educate, influence, and engage employees and stakeholders in building a security-conscious culture.

Strategic and Hands-On Mindset: Ability to balance security requirements with operational agility, combining long-term strategic planning with direct involvement in key initiatives.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1