YOU WILL BE RESPONSIBLE FOR
Assess security gaps across business processes and technologies, enable effective risk treatment, and define remediation plans with clear owners and deadlines.
Work closely with ITSec, Risk, Procurement stakeholders to align on mitigation of identified risks and on risk acceptance decisions.
Lead the evolution of the TPRM program toward a risk-based, lifecycle model: onboarding, continuous monitoring, offboarding, and fourth-party visibility.
Define/review security requirements for third parties, including contractual security clauses and annexes, and guide business owners on their application.
Build and scale automation and AI-assisted assessment capabilities that reduce manual questionnaire effort and increase coverage.
Report third-party risk posture and trends to leadership and relevant committees.
Drive human risk programs through phishing simulations, training and communication and evaluate and evolve the tooling behind them (build versus buy).
Define and track behavior-change metrics that go beyond completion rates, and report them through dashboards for management.
Act as technical lead across the squad, raising the technical and analytical bar and fostering continuous improvement.
WE ARE LOOKING FOR A PERSON WHO HAS
Proven experience designing and implementing security controls and leading risk management initiatives, with strong knowledge of domains and concepts of cyber risks.
Hands-on experience with risk analysis techniques: risk identification, assessment and prioritization, using both qualitative and quantitative methods.
Experience with TPRM (third-party risk management).
Experience building or running security awareness and human-risk programs, or a strong ability to ramp up on them quickly.
Experience with large-scale distributed environments and cloud environments (e.g. AWS, GCP, Azure).
Familiarity with frameworks such as NIST CSF, NIST SP 800-30, ISO 27001/27002/27005, ISO 31000, PCI-DSS, ITIL, COBIT and similar.
Excellent executive communication skills, able to translate complex topics into clear, actionable insights for senior leadership and committees.
Technical background and comfort with automation, scripting and AI or LLM-based tooling to scale security processes.
Experience operating in regulated and global environments, including interaction with auditors and regulators.
Proven ability to lead projects and process improvement initiatives, and to mentor other engineers and analysts.
Advanced English proficiency, written and spoken. Spanish is a plus.
NICE TO HAVE
Bachelor’s degree in Engineering, Technology, Information Security, Risk Management or related fields.
Certifications such as PCI ISA or PCIP, CISA, CISM or CISSP.
Experience in a regulated fintech, financial services environment or consulting roles.
Experience with AI risk: assessing risks of generative AI and LLM use cases (data leakage, prompt injection, model and vendor risk)
LOCATION FOR THIS OPPORTUNITY (CITY, COUNTRY)
São Paulo, Brazil
Campinas, Brazil
Rio de Janeiro, Brazil
Belo Horizonte, Brazil
BENEFITS
Chance of earning equity at Nubank
Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
Public Transportation Commuting Benefit (Vale-Transporte)
NuCare – Psychological, Financial and Legal Assistance Program
Life Insurance
Medical Plan
Dental Plan
NuLanguage – Language Course Program
Nucleo - Our learning platform of courses
Extended Parental Leave
Daycare Allowance
Parental Consultancy
Work-from-home Allowance
Gym Partnerships
30 days of paid vacation
Relocation Assistance Package, if applicable
WORK MODEL FOR THIS ROLE
Hybrid 2-3 times/week: Our hybrid work model brings us to the office at least twice a week, on strategic days designed to maximize team connection and collaboration. For more details, visit https://building.nubank.com/nu-hybrid-work-model/
Our recruitment process may involve the use of artificial intelligence–enabled tools, such as automated interview transcription and analysis, to support the evaluation process. Artificial intelligence is not used to make final hiring decisions; all decisions are made by human reviewers.
To maintain a consistent and fair process for every candidate, Nu does not provide individualized technical feedback. See how our policy works here https://script.google.com/a/macros/nubank.com.br/s/AKfycbwvrewE58oGSbRWIVv8CyCWN68GLxpPVsfYYXv-ZHg94QFsTJmi82rF1x0yt-OTs2W0DQ/exec
