Nubank

More roles at Nubank

Lead Security Engineer - Vulnerability Management

Hybrid

Part remote, part office, you need to live within commuting distance of a named location.

Hybrid · São Paulo

Employer listed it 4 weeks ago · Added 4 weeks ago

Been open since 4 weeks ago, still being checked, but it has been live a while.

Salary

Not stated

Location

Hybrid · São Paulo

Timezone

Not stated

Contract

Full-time

Experience

Lead

What the advert says

Quoted word for word from the employer's advert. Where it says nothing, we say so.

Working hours: Not mentioned in the advert
Where you can work from: Hybrid 2-3 times/week: Our hybrid work model brings us to the office at least twice a week, on strategic days designed to maximize team connection and collaboration.
Contract: Not mentioned in the advert
Experience asked for: Not mentioned in the advert
Pay: Not mentioned in the advert

Remote flexibility

Hybrid

This role is only partly remote, the employer expects time in the office around São Paulo, Hybrid, so you need to live within commuting distance.

What the employer says

Source listing states candidate location: "São Paulo, Hybrid"
Listing mentions "Hybrid"

What Nomaders makes of it

Not suitable if you plan to move between countries

The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.

Before you apply

Questions worth asking: Nomaders interpretation

This role involves office time, but the advert does not say how often. Ask how many days a week are expected on site.
No pay is stated. Ask for the salary range before investing time in interviews.
The advert does not say whether this is employment or a contractor arrangement. Ask, as it affects tax and benefits.

Produced automatically from this advert's text; not reviewed by a person. The employer's own page is the final word.

About the role

About Nu

Nu serves more than 140 million customers, guided by a mission to fight complexity and empower people. The company has been leading an industry transformation through innovative products and human-centered services.

Proprietary technology and data at scale power Nu’s digital platform, built to promote financial access, advancement, and transparency. Its business model thrives on customer love and lower costs, feeding a flywheel of growth and profitability. Visit our Institutional Page

About the role

As a Lead Security Engineer, you will operate as a technical leader within Vulnerability Management, owning complex and ambiguous problems that span multiple teams and business areas.

You will help evolve Nubank’s vulnerability management capabilities into a scalable, auditable and risk-driven program. This includes improving detection and asset coverage, strengthening ownership and remediation workflows, increasing automation, supporting regulatory and audit readiness, and enabling engineering teams to resolve vulnerabilities efficiently.

This role requires strong autonomy, deep security engineering expertise, sound judgment and the ability to influence stakeholders without relying on formal authority. The role is aligned with IC6 expectations: leading complex cross-functional initiatives, setting standards, making technical decisions and acting as a multiplier for the broader organization.

You can find more about Nubank Infosec here: https://blog.nubank.com.br/infosec-nubank-protecao-dados/

You will be responsible for

Lead initiatives that improve the end-to-end vulnerability management lifecycle, from discovery and prioritization through remediation, verification and closure.

Design and evolve scalable processes, controls, workflows and automations for vulnerability intake, enrichment, ownership resolution, prioritization and SLA tracking.

Drive improvements across vulnerability identification sources, including cloud and infrastructure scanners, GitHub security findings, offensive security assessments, bug bounty reports, external assessments and threat intelligence.

Partner with Engineering, AppSec, Cloud Security, Offensive Security, Risks and other stakeholders to remove blockers and drive timely remediation.

Provide technical guidance on complex vulnerabilities, including risk context, remediation options, compensating controls and residual risk.

Lead root-cause analysis for recurring findings, data-quality problems, ownership gaps and workflow failures.

Define and improve metrics, dashboards and reporting that enable risk-based prioritization and executive decision-making.

Support regulatory, audit and compliance activities by ensuring that processes, evidence and remediation records are complete and auditable.

Contribute to the evolution of VM architecture, tooling and integrations, reducing operational toil and technical debt using AI tools.

Mentor engineers, share knowledge and raise the technical and operational bar across the security organization.

Participate in hiring and help build a strong, diverse and collaborative security engineering team.

We are looking for a person who has

Significant experience in information security, security engineering, vulnerability management, application security, cloud security or a related discipline.

Deep understanding of vulnerability management principles, including risk-based prioritization, remediation processes, verification and SLAs.

Experience designing or operating security controls and processes at scale.

Requirements

The employer hasn't listed requirements separately, they're described in the role summary above and on the original listing.

Benefits

·Chance of earning equity at Nubank
·Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
·Public Transportation Commuting Benefit (Vale-Transporte)
·NuCare – Psychological, Financial and Legal Assistance Program
·NuLanguage – Language Course Program

How to apply

1Check the flexibility label above, hybrid, matches where you plan to live and work.
2Tailor your CV to the role at Nubank, mentioning your remote working experience.
3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.

Found 27d ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.

Listing sourced from Company boards.

Pay not stated · You'll be taken to the employer's careers page.