Lead Security Engineer - GRC

Responsibilities

• Assess security gaps across business processes, technologies and third parties, and define remediation plans with owners and deadlines.
• Coordinate with IT Security, Risk and Procurement stakeholders on mitigation and risk-acceptance decisions.
• Lead the TPRM program across onboarding, continuous monitoring, offboarding and fourth-party visibility.
• Define and review third-party security requirements, contractual clauses and annexes.
• Build automation and AI-assisted assessment capabilities to reduce manual questionnaire work and increase coverage.
• Report third-party risk posture and trends to leadership and relevant committees.
• Drive phishing simulations, training, communications and other human-risk programs.
• Define behavior-change metrics and report them through management dashboards.
• Act as the squad's technical lead, mentor engineers and analysts, and drive process improvement.

Requirements

• Proven experience designing and implementing security controls and leading cyber-risk management initiatives.
• Hands-on experience with qualitative and quantitative risk identification, assessment and prioritization.
• Experience with third-party risk management and security awareness or human-risk programs.
• Experience with large-scale distributed and cloud environments, including AWS, GCP or Azure.
• Familiarity with NIST CSF, NIST SP 800-30, ISO 27001, ISO 27002, ISO 27005, ISO 31000, PCI-DSS, ITIL and COBIT.
• Strong executive communication skills for translating complex security topics into actionable recommendations.
• Technical background with automation, scripting and AI or LLM-based tooling.
• Experience in regulated and global environments, including working with auditors and regulators.
• Ability to lead projects, improve processes and mentor engineers and analysts.
• Advanced written and spoken English; Spanish is a plus.
• Bachelor's degree in engineering, technology, information security, risk management or a related field is preferred.
• Certifications such as PCI ISA, PCIP, CISA, CISM or CISSP are preferred.
• Experience in fintech, financial services or consulting is preferred.
• Experience assessing generative-AI and LLM risks, including data leakage, prompt injection, model risk and vendor risk, is preferred.

Benefits

• Equity opportunity at Nubank.
• Food or meal card, public transportation commuting benefit, life insurance, medical plan and dental plan.
• NuCare psychological, financial and legal assistance program.
• NuLanguage language courses and Nucleo learning platform.
• Extended parental leave, daycare allowance and parental consultancy.
• Work-from-home allowance and gym partnerships.
• 30 days of paid vacation.
• Relocation assistance package, if applicable.
• Hybrid work model requiring office attendance at least 2-3 times per week in São Paulo, Campinas, Rio de Janeiro or Belo Horizonte, Brazil.