Head de Segurança da Informação

BrazilRemoteFull-time

Other

0 views0 saves0 applied

Apply Now

Quick Summary

Requirements Summary

Design and manage security awareness programs to promote safe behaviors across the organization. Coordinate continuous social engineering simulations and phishing campaigns across email, SMS,

Technical Tools

Other

We are looking for a strategic and hands-on Information Security leader to oversee cybersecurity, data protection, and business continuity within a fast-growing technology and financial services environment. In this role, you will define and drive the organization's security strategy while managing cyber risks, regulatory compliance, and security governance. You will work closely with senior leadership, technical teams, and external partners to ensure that security enables business growth rather than creating unnecessary obstacles. The position combines strategic decision-making with direct execution in a lean and dynamic structure. You will also lead initiatives to strengthen security awareness, improve operational resilience, and protect critical business assets. This is an opportunity to shape a mature security culture while supporting innovation and scalable financial technology solutions.

Security Governance and Risk Management: Develop, implement, and maintain information security policies, standards, and procedures, including operational guidelines for back-office activities. Maintain the cybersecurity risk register and key indicators, establish third-party risk management policies, and lead monthly Security and Fraud Committee meetings with senior leadership.
Regulatory Compliance and Auditing: Ensure ongoing compliance with Brazil's General Data Protection Law (LGPD), applicable Central Bank regulations, and financial partners' security requirements. Support the Data Protection Officer (DPO), oversee critical access audits, and coordinate internal and external security audits.
Security Awareness and Culture: Design and manage security awareness programs to promote safe behaviors across the organization. Coordinate continuous social engineering simulations and phishing campaigns across email, SMS, and phone channels, strengthening employees' role as the first line of defense.
Incident Response and Third-Party Management: Select, contract, evaluate, and manage external security providers, including 24/7 Security Operations Center (SOC) and Managed Detection and Response (MDR) services, penetration testing consultancies, and SaaS security platforms. Coordinate incident response plans, business continuity plans, and disaster recovery strategies.
Team Leadership and Budget Management: Lead, mentor, and develop the information security team, establishing priorities, objectives, and performance expectations. Prepare and manage the department's budget, covering personnel, tools, and external services.
Security Roadmap and Infrastructure Protection: Oversee the continuous improvement of the organization's security infrastructure, including identity and access management initiatives and the Critical Access Management Program.
Fraud Prevention: Coordinate security and fraud prevention initiatives, considering both transactional and internal fraud risks, and ensure effective collaboration between relevant business and technical stakeholders.

Requirements

~2 min read

Professional Experience: Proven experience in IT governance, information security leadership, and cybersecurity risk management, preferably in financial institutions, fintech companies, credit businesses, or payment service providers.
Security Frameworks: Strong knowledge of recognized security frameworks and best practices, particularly ISO 27001, CIS Controls, and NIST.
Regulatory Knowledge: Practical understanding of LGPD requirements and applicable Central Bank of Brazil regulations concerning cybersecurity, information security, and third-party service contracting.
Business Continuity and Incident Management: Demonstrated experience developing and coordinating Business Continuity Plans (BCP), Incident Response Plans (IRP), and disaster recovery strategies.
Third-Party and SLA Management: Ability to evaluate, negotiate, contract, and audit managed security services, including SOC operations, penetration testing providers, and security awareness platforms.
Leadership Experience: Previous experience managing and developing technical teams, including smaller or specialized teams.
Technical Foundation: Sufficient knowledge of cloud environments, identity and access management, cybersecurity operations, and incident response to guide technical teams and assess external providers.
Fraud Prevention: Understanding of transactional and internal fraud risks, with the ability to coordinate prevention strategies and support security and fraud governance.
Executive Communication: Ability to translate complex technical concepts and cybersecurity risks into clear business impacts and actionable recommendations for senior leadership.
Leadership and Collaboration: Strong interpersonal skills, empathy, and the ability to educate, influence, and engage employees and stakeholders in building a security-conscious culture.
Strategic and Hands-On Mindset: Ability to balance security requirements with operational agility, combining long-term strategic planning with direct involvement in key initiatives.
Crisis Management: Strong organizational skills, resilience, emotional intelligence, and sound judgment when managing incidents, critical situations, and competing priorities.