IT Governance, Security, and FinOps Specialist

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Develop and uphold governance processes for Information Security and FinOps, which encompass policies, responsibilities, metrics, and review schedules.

• Oversee the vulnerability management process by aggregating findings from scanning tools and CVE advisories, categorizing severity levels, assigning responsibilities to relevant teams, and monitoring remediation timelines.

• Coordinate and offer administrative support to the Security and Cost (FinOps) committees, which includes preparing agendas and materials, documenting decisions, and tracking action plans until their completion.

• Ensure managers and teams are held accountable for unresolved security and cost-related issues, and escalate critical risks and delays to upper management.

• Aggregate and categorize cloud costs by squad and product, oversee tagging and actual expenditures against budget, and identify discrepancies along with optimization opportunities.

• Generate executive reports and dashboards regarding vulnerabilities, compliance, and costs, presenting these monthly to the technology steering committee.

• Maintain up-to-date policies, controls, and evidence for audits, customer evaluations, and compliance with Brazil’s LGPD data protection regulations.

• Act as the central coordination point among engineering, infrastructure, product, and leadership, fostering compliance with governance processes.

⛳️ Requirements

• Proven experience in IT Governance, GRC, or Information Security management, ideally within technology firms operating in cloud environments.

• Strong understanding of the vulnerability management lifecycle, including CVEs, CVSS, risk-based prioritization, and remediation timelines.

• Capability to interpret reports from scanning tools and engage in discussions regarding findings with technical teams.

• Familiarity with FinOps and cloud billing, which includes cost allocation, tagging, reserved instances, and budget monitoring.

• Experience in leading committees and governance activities, ensuring action plans are followed up on effectively.

• Advanced proficiency in data organization and analysis using spreadsheets and BI tools.

• Excellent communication skills and a proactive approach to ensuring deadlines are met and priorities are aligned with managers and technical teams.

• An organized and process-oriented mindset, with the independence to create processes from scratch.

• Knowledge of frameworks such as ISO 27001, NIST CSF, CIS Controls, COBIT, or ITIL.

• Relevant certifications such as FinOps Certified Practitioner, ISO 27001 Lead Implementer or Lead Auditor, CompTIA Security+, or CISM.

• Experience with security tools like Snyk, SonarQube, Trivy, Dependabot, or similar technologies.

• Familiarity with cloud cost management tools such as AWS Cost Explorer/CUR, GCP Billing, or comparable solutions.

• Proficiency in SQL for data extraction and cross-referencing purposes.

• Experience using Jira or similar platforms for managing outstanding tasks and action plans.

• Background in supporting LGPD compliance and addressing customer security inquiries.

• Extensive experience and comprehensive knowledge of Spring Boot and the Spring ecosystem.

• Familiarity with building unit and integration tests utilizing JUnit.

• Experience with relational and in-memory databases; knowledge of NoSQL databases is a plus.

• Understanding of Spring Boot, Spring Data, Spring Cloud, Spring Security, JPA, and Hibernate.

• Familiarity with Spring Cloud Function.

• Experience working with message brokers.

🏝️ Benefits

• Remote work.

• Position is also open to candidates with disabilities.