Head of Information Security

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Establish the overall security strategy and assume direct responsibility for the organization’s cybersecurity risks.

• Develop, revise, and uphold security policies, standards, and procedures, along with back-office operational guidelines.

• Maintain the cybersecurity risk map and its associated indicators current.

• Formulate the third-party risk policy and chair the monthly Security and Fraud Committee alongside executive leadership.

• Ensure continuous compliance with Brazil’s General Data Protection Law (LGPD), relevant Central Bank of Brazil regulations, and requirements from financial partners.

• Assist the DPO with privacy-related requests, audit the Critical Access Program, and take responsibility for both internal and external audits.

• Oversee the Security Awareness program, conduct social engineering simulations, and manage phishing campaigns.

• Source, evaluate, and supervise outsourced security providers, which include 24/7 SOC/MDR services, SaaS tools, and penetration-testing consultancies.

• Coordinate the Incident Response Plan, Business Continuity Plans, and Disaster Recovery Plans.

• Lead and nurture the security team, establishing objectives and priorities.

• Prepare and oversee the departmental budget, while tracking the evolution roadmap of security infrastructure, including the Critical Access Program.

⛳️ Requirements

• Extensive experience in IT governance and security, cybersecurity risk management, and security frameworks such as ISO 27001, CIS Controls, or NIST.

• In-depth understanding of Brazil’s LGPD and Central Bank of Brazil regulations related to cybersecurity and service procurement.

• Demonstrated experience in developing and coordinating Business Continuity Plans (BCP) and Incident Response Plans (IRP).

• Proficiency in negotiating, procuring, and auditing managed security services, including SOC, penetration testing, and security awareness platforms.

• Experience in managing technical teams, even if they are small.

• Background in financial institutions, fintechs, or companies in credit and payments.

• Adequate knowledge of cloud computing, identity management, and incident response to effectively guide the technical team and evaluate vendors.

• Insight into transactional and internal fraud.

• Ability to articulate complex technical terminology and risks in terms of clear business implications for executive leadership.

• Empathy, strong communication and teaching abilities, along with creativity to enhance team awareness and engage leaders in fostering a security culture.

• Capability to balance security needs with operational agility, being willing to directly execute deliverables.

• Methodical organization and emotional intelligence to manage incidents or high-pressure situations calmly and effectively.

🏝️ Benefits

• Caju (meal and food allowance): BRL 2,040.00.

• Bonus: annual additional compensation of up to 3x monthly compensation, contingent on the team's overall performance.

• SOP: eligible to join our Stock Option Program after 12 months.

• Holistic Health: BRL 400.00 dedicated to physical and mental health via the Keiken platform, plus access to the Wellhub platform.

• Health plan: reimbursement allowance of up to BRL 850.00 for an individual health plan, medical exams, or consultations.

• Time off: 15 business days of paid time off annually.

• Holiday break: one week off during the Christmas or New Year’s week, arranged in coordination with the team.

• One additional payment at the end of the year.

• Financial support for specialization courses related to your field of work.

• Remote First: work from any location of your choice.

• No Dress Code: wear what is most comfortable for you.

• Day Off: one day off during your birthday month to celebrate.

• Semi-flexible working hours.