Grupo QuintoAndar | Information Security Manager - GRC
$150,000–$200,000 year
On-siteSão Paulo, São Paulo, Brazil
Job Summary
Develop and execute the GRC strategy roadmap aligned with business objectives, budget, and risk appetite. Lead the strategic PMO for Cybersecurity, prioritizing the project portfolio alongside the CISO to ensure security enables critical cross-company initiatives. Own the security service channel and portfolio, acting as the primary intake and coordination point for requests while managing investment, internal teams, and third-party partners. Establish AI governance guidelines, controls, and policies for safe technology use, and lead IAM governance projects ensuring alignment with SOX and risk requirements. Drive end-to-end cyber risk management, financially quantifying risk using FAIR methodologies, and oversee third-party risk and cyber resilience programs. Ensure continuous compliance with regulations like LGPD and GDPR, acting as the voice for internal and external audits. Lead the security awareness strategy to transform the human factor into the first line of defense and structure the policy framework. Report strategic and operational metrics to executive leadership through the Information Security Committee.
Required Qualifications
- 10+ years of experience in Information Security GRC
- at least 5 years in leadership and team management roles within complex, dynamic, and multinational corporate environments
- Proven experience reporting to, presenting to, and influencing executives and stakeholders
- Experience managing security demand intake and portfolio prioritization
- Deep mastery and critical vision in structuring frameworks and standards such as NIST CSF 2.0, ISO 27001/27002, CIS Controls, privacy methodologies, and ISO 31000
- Exceptional ability to translate technical cyber risks (e.g., cloud vulnerabilities) into financial and operational impacts using methodologies such as FAIR
- Experience designing and operationalizing security KPI/KRI frameworks and maturity models for executive reporting
- Experience sponsoring governance for critical incident response and cyber crisis management
- Direct experience engaging with regulators and external auditors during compliance reviews
- Experience designing vendor risk assessment methodologies and TPRM programs
- Practical experience in AI Governance, including the definition of guidelines, controls, and policies for the safe, ethical, and compliant use of AI within the company
- Experience leading IAM Governance initiatives, ensuring identity and access management controls and processes are aligned with the company's risk and compliance requirements
- Experience supporting SOX compliance programs, including IT General Controls (ITGC)
- Experience designing and running security awareness and behavior change programs
- GRC Engineering mindset: ability to use automation and AI to solve GRC problems at scale
- Fluency in Portuguese
- advanced/fluent English
Desired Qualifications
- preferably tech companies, scale-ups, or the financial sector
- Certifications such as CISSP, CISM, CRISC, or ISO 27001 Lead Auditor
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.