Nubank

More roles at Nubank

Lead Security Engineer - GRC

Hybrid

Part remote, part office, you need to live within commuting distance of a named location.

Hybrid · São Paulo

Employer listed it 5 days ago · Added 2 days ago

First listed 5 days ago and still open.

Salary

Not stated

Location

Hybrid · São Paulo

Timezone

Not stated

Contract

Full-time

Experience

Lead

What the advert says

Quoted word for word from the employer's advert. Where it says nothing, we say so.

Working hours: Not mentioned in the advert
Where you can work from: This is a multidisciplinary and global role, working with teams primarily based in Brazil, Mexico, Colombia, and the United States.
Contract: Not mentioned in the advert
Experience asked for: Not mentioned in the advert
Pay: Not mentioned in the advert

Remote flexibility

Hybrid

This role is only partly remote, the employer expects time in the office around São Paulo, Campinas, Belo Horizonte, Rio de Janeiro, Hybrid, so you need to live within commuting distance.

What the employer says

Source listing states candidate location: "São Paulo, Campinas, Belo Horizonte, Rio de Janeiro, Hybrid"
Listing mentions "Hybrid"

What Nomaders makes of it

Not suitable if you plan to move between countries

The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.

Before you apply

Questions worth asking: Nomaders interpretation

This role involves office time, but the advert does not say how often. Ask how many days a week are expected on site.
No pay is stated. Ask for the salary range before investing time in interviews.
The advert does not say whether this is employment or a contractor arrangement. Ask, as it affects tax and benefits.

Produced automatically from this advert's text; not reviewed by a person. The employer's own page is the final word.

About the role

About Nu

Nu serves more than 140 million customers, guided by a mission to fight complexity and empower people. The company has been leading an industry transformation through innovative products and human-centered services.

Proprietary technology and data at scale power Nu’s digital platform, built to promote financial access, advancement, and transparency. Its business model thrives on customer love and lower costs, feeding a flywheel of growth and profitability. Visit our Institutional Page

About the role

As a Lead Security Engineer you will be a senior technical and risk reference who moves where the risk is, across TPRM, Security Awareness and Cyber Risk, rather than owning a single silo. You will assess security gaps across diverse technologies, third parties and business contexts, quantify what matters, and turn it into prioritized, actionable treatment plans that leadership can decide on.

You will build and evolve the policies, methodologies, platforms and automation behind these programs, and help the squad scale across Brazil, Mexico, Colombia, and other geos without scaling headcount linearly. You will partner with Engineering, Product, Legal, Procurement, Operations, Internal Communication, Risk teams and the business stakeholders to translate requirements into clear, pragmatic technical specifications. This is a multidisciplinary and global role, working with teams primarily based in Brazil, Mexico, Colombia, and the United States.

You will be responsible for

Assess security gaps across business processes and technologies, enable effective risk treatment, and define remediation plans with clear owners and deadlines.

Work closely with ITSec, Risk, Procurement stakeholders to align on mitigation of identified risks and on risk acceptance decisions.

Lead the evolution of the TPRM program toward a risk-based, lifecycle model: onboarding, continuous monitoring, offboarding, and fourth-party visibility.

Define/review security requirements for third parties, including contractual security clauses and annexes, and guide business owners on their application.

Build and scale automation and AI-assisted assessment capabilities that reduce manual questionnaire effort and increase coverage.

Report third-party risk posture and trends to leadership and relevant committees.

Drive human risk programs through phishing simulations, training and communication and evaluate and evolve the tooling behind them (build versus buy).

Define and track behavior-change metrics that go beyond completion rates, and report them through dashboards for management.

Act as technical lead across the squad, raising the technical and analytical bar and fostering continuous improvement.

We are looking for a person who has

Proven experience designing and implementing security controls and leading risk management initiatives, with strong knowledge of domains and concepts of cyber risks.

Hands-on experience with risk analysis techniques: risk identification, assessment and prioritization, using both qualitative and quantitative methods.

Experience with TPRM (third-party risk management).

Experience building or running security awareness and human-risk programs, or a strong ability to ramp up on them quickly.

Experience with large-scale distributed environments and cloud environments (e.g. AWS, GCP, Azure).

Familiarity with frameworks such as NIST CSF, NIST SP 800-30, ISO 27001/27002/27005, ISO 31000, PCI-DSS, ITIL, COBIT and similar.

Excellent executive communication skills, able to translate complex topics into clear, actionable insights for senior leadership and committees.

Requirements

The employer hasn't listed requirements separately, they're described in the role summary above and on the original listing.

Benefits

·Chance of earning equity at Nubank
·Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
·Public Transportation Commuting Benefit (Vale-Transporte)
·NuCare – Psychological, Financial and Legal Assistance Program
·NuLanguage – Language Course Program

How to apply

1Check the flexibility label above, hybrid, matches where you plan to live and work.
2Tailor your CV to the role at Nubank, mentioning your remote working experience.
3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.

Found 3d ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.

Listing sourced from Company boards.