3 days ago
São Paulo, Brazil +2 moreStaff+
Responsibilities
- Assess security gaps across business processes, technologies and third parties, and define remediation plans with owners and deadlines.
- Coordinate with IT Security, Risk and Procurement stakeholders on mitigation and risk-acceptance decisions.
- Lead the TPRM program across onboarding, continuous monitoring, offboarding and fourth-party visibility.
- Define and review third-party security requirements, contractual clauses and annexes.
- Build automation and AI-assisted assessment capabilities to reduce manual questionnaire work and increase coverage.
- Report third-party risk posture and trends to leadership and relevant committees.
- Drive phishing simulations, training, communications and other human-risk programs.
- Define behavior-change metrics and report them through management dashboards.
- Act as the squad's technical lead, mentor engineers and analysts, and drive process improvement.
Requirements
- Proven experience designing and implementing security controls and leading cyber-risk management initiatives.
- Hands-on experience with qualitative and quantitative risk identification, assessment and prioritization.
- Experience with third-party risk management and security awareness or human-risk programs.
- Experience with large-scale distributed and cloud environments, including AWS, GCP or Azure.
- Familiarity with NIST CSF, NIST SP 800-30, ISO 27001, ISO 27002, ISO 27005, ISO 31000, PCI-DSS, ITIL and COBIT.
- Strong executive communication skills for translating complex security topics into actionable recommendations.
- Technical background with automation, scripting and AI or LLM-based tooling.
- Experience in regulated and global environments, including working with auditors and regulators.
- Ability to lead projects, improve processes and mentor engineers and analysts.
- Advanced written and spoken English; Spanish is a plus.
- Bachelor's degree in engineering, technology, information security, risk management or a related field is preferred.
- Certifications such as PCI ISA, PCIP, CISA, CISM or CISSP are preferred.
- Experience in fintech, financial services or consulting is preferred.
- Experience assessing generative-AI and LLM risks, including data leakage, prompt injection, model risk and vendor risk, is preferred.
Benefits
- Equity opportunity at Nubank.
- Food or meal card, public transportation commuting benefit, life insurance, medical plan and dental plan.
- NuCare psychological, financial and legal assistance program.
- NuLanguage language courses and Nucleo learning platform.
- Extended parental leave, daycare allowance and parental consultancy.
- Work-from-home allowance and gym partnerships.
- 30 days of paid vacation.
- Relocation assistance package, if applicable.
- Hybrid work model requiring office attendance at least 2-3 times per week in São Paulo, Campinas, Rio de Janeiro or Belo Horizonte, Brazil.
Tech Stack
Categories
About Nubank
Nubank is a digital banking platform for consumers and small businesses in Latin America, offering a no-fee credit card, accounts, payments, lending, and investments through Nu Asset Management. It monetizes via interchange, interest, and product fees within its app-based ecosystem. Founded in 2013 and headquartered in São Paulo, it serves over 100 million customers across Brazil, Mexico, and Colombia and is listed on the NYSE (ticker: NU).