Senior Security Governance Analyst

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Maintain ISO 27001, ISO 22301, and PCI DSS certifications by overseeing the annual cycle of scope, controls, evidence, certification audits, and non-conformity management.

• Ensure compliance with CMN Resolution No. 4,893 and BCB No. 85 by mapping requirements for controls, monitoring regulatory changes, and reporting gaps and action plans to leadership.

• Manage the Information Security Management System (ISMS): risks, indicators, critical analyses by management, internal audits, and continuous improvement.

• Develop, implement, and maintain security policies, standards, and procedures with a defined review cycle and effective adoption by the various departments.

• Assess vendors, partners, and acquisitions (TPRM): conduct security due diligence, classify criticality, analyze questionnaires and evidence, and continuously monitor third-party risk.

• Lead business continuity management: conduct impact analysis (BIA), develop continuity and recovery plans, and perform periodic tests and exercises with responsible areas.

• Plan and execute the security engagement and awareness program, including training, campaigns, and effectiveness metrics.

• Support internal and external audits by coordinating requests, evidence, and responses, and ensuring follow-up on findings until resolution.

⛳️ Requirements

• Proven senior-level experience in Governance, Risk, and Compliance (GRC) in Information Security, preferably within a fintech, payment institution, or regulated financial sector.

• Practical experience in maintaining an ISMS compliant with ISO 27001 and supporting a certification, including certification audit cycles.

• Strong knowledge of PCI DSS requirements and experience in its evidence and assessments.

• Familiarity with Brazilian financial sector regulations applicable to cybersecurity and continuity (CMN Resolutions No. 4,893 and BCB No. 85).

• Experience in third-party risk management (TPRM): evaluating vendors and partners based on criticality.

• Experience in supporting internal and external audits, directly interacting with auditors and regulators.

• Advantage: experience with ISO 22301 and business continuity management (BIA, plans, and tests).

• Advantage: knowledge of SOX and general IT controls (ITGC).

• Advantage: certifications such as ISO 27001 Lead Implementer/Auditor, ISO 22301 Lead Implementer/Auditor, CISA, CISM, CRISC, or PCI ISA.

• Advantage: experience with GRC tools and security awareness programs.

• Fluent in Portuguese. Technical English for reading and writing documentation.

🏝️ Benefits

• Competitive and market-aligned salary.

• Remote work — wherever you are, you’re part of the team!

• Home office allowance through a monthly deposit in the RecargaPay app.

• Health and dental plans with no co-pay.

• Life insurance.

• Flexible meal allowance (via Flash).

• TotalPass membership to take care of your health.

• Salário competitivo e alinhado ao mercado.

• Trabalho remoto — esteja onde estiver, você faz parte do time!

• Auxílio home office com um depósito mensal no app RecargaPay.

• Plano de saúde e odontológico sem coparticipação.

• Seguro de vida.

• Vale-refeição flexível (via Flash).

• TotalPass para cuidar da sua saúde.