Head of security

Jobgether; Brasil; Remote; BRL 400.000 - 800.000; Vollzeit

Benefits dieser Stelle

Fully remote Brazil

Leadership role

Zusammenfassung

Jobgether is seeking a Head of Security for a fully remote role in Brazil. You will define the security strategy for a global fintech platform, lead incident response, and embed security across development and operations.

You will govern AI security, cryptographic practices, and compliance programs while coordinating with cross-functional teams. The role requires 8+ years in information security, 3+ years of leadership, and strong cloud and application security expertise across AWS, Kubernetes,

Qualifikationen

• 8+ years in information security or application security.
• 3+ years leading security teams or functions.
• Experience with cloud security and fintech environments.

Aufgaben

• Define and own a risk-based security strategy and roadmap.
• Lead incident response, with post-incident reviews for improvements.
• Integrate security into SDLC with threat modeling and reviews.
• Oversee cloud security in AWS, Kubernetes, IAM, and CI/CD.
• Develop threat detection, monitoring, and risk-based SLAs.

Kenntnisse

Security leadership

Incident response

AWS security

Kubernetes security

Threat modeling

SOC 2

ISO 27001

PCI DSS

CI/CD security

Terraform

AI security

Executive communication

TypeScript review

Node.js reading

RBAC

Cloud security

Ausbildung

Bachelor's degree in CS or related field

Tools

Datadog

Jobbeschreibung

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Head of Security based in Brazil.

In this strategic leadership role, you will define and drive the security strategy for a global financial technology platform supporting cross-border payments and digital financial services. You will oversee the security of applications, cloud infrastructure, identity systems, payment operations, and third-party integrations while protecting sensitive data and financial assets. Working closely with engineering leadership and cross-functional teams, you will embed security into the software development lifecycle and enable teams to innovate without compromising resilience. You will lead incident response, strengthen threat detection capabilities, and oversee compliance and risk management across a complex technical environment. You will also shape the safe adoption of AI-assisted development tools, autonomous agents, and LLM-powered systems. This is an opportunity to build and scale a security function, influence executive-level decisions, and establish security as a strategic business enabler in a fast-growing, fully remote environment.

Accountabilities

• Security Strategy and Leadership: Define and own a risk-based security strategy and roadmap, prioritizing initiatives according to threat exposure, business impact, and operational risk. Communicate security posture, priorities, and investment needs to executive leadership and the board.
• Incident Response and Resilience: Lead the detection, investigation, containment, and recovery of security incidents. Maintain incident response playbooks, coordinate with external forensic specialists, legal counsel, and communications teams, and conduct post-incident reviews to drive continuous improvement.
• Application Security: Integrate security throughout the software development lifecycle through threat modeling, secure architecture reviews, code reviews, security testing, dependency scanning, and practical secure coding standards.
• Cloud and Infrastructure Security: Partner with infrastructure teams to strengthen security across AWS, Kubernetes, networking, and CI/CD pipelines. Oversee identity and access management, least-privilege controls, secrets management, and security practices for Terraform and GitOps workflows.
• Threat Detection and Monitoring: Develop and improve security monitoring, logging, alerting, and detection capabilities across applications, infrastructure, and access systems. Optimize detection rules to identify malicious activity early while minimizing false positives.
• Cryptographic and Key Management Security: Define and maintain security controls for cryptographic keys, wallets, custody operations, and blockchain integrations supporting payment infrastructure.
• Fraud and Account Protection: Collaborate with Product and Risk teams to strengthen defenses against account takeover, fraudulent activity, abuse, and suspicious transactions.
• AI Security and Governance: Establish security guardrails for AI-assisted coding tools, AI agents, and LLM-powered systems. Address risks such as prompt injection, unauthorized tool access, excessive agent permissions, and sensitive data exposure.
• Compliance and Security Assurance: Lead the security compliance program, including SOC 2 and other relevant frameworks, audit preparation, customer assessments, and security questionnaires. Integrate compliance requirements into everyday engineering practices.
• Third-Party and Vendor Risk: Manage vendor security assessments and due diligence for strategic partners, investors, acquirers, and other external stakeholders.
• Vulnerability and Patch Management: Establish risk-based remediation timelines and severity-based SLAs, coordinating with engineering teams to address vulnerabilities efficiently without creating unnecessary delivery bottlenecks.
• Team Building and Mentorship: Recruit, develop, and lead security professionals while establishing a security champions network across product teams and raising security awareness throughout engineering.
• Production Security Escalation: Participate in and help define security escalation procedures for production incidents, ensuring effective coordination, timely decisions, and clear accountability.

Requirements

• At least 8 years of experience in information security or application security, including 3 or more years leading security teams or security functions.
• Demonstrated experience managing high-impact security incidents, including coordinating investigations with external forensic specialists and legal counsel.
• Strong hands‑on knowledge of AWS and Kubernetes security, including IAM, network segmentation, role-based access control (RBAC), secrets management, container security, and image protection.
• Proven experience implementing application security in microservices environments, including threat modeling, secure code reviews, dependency management, and software supply-chain risk mitigation.
• Experience building and operating security monitoring and detection capabilities, including SIEM solutions, log analysis, alerting, and tools such as Datadog or equivalent platforms.
• Experience owning or leading security compliance programs such as SOC 2, ISO 27001, or PCI DSS, including audit preparation and execution.
• Ability to read and review TypeScript and Node.js code, as well as infrastructure-as-code configurations using Terraform, and communicate effectively with software engineers.
• Practical experience securing CI/CD pipelines and managing software supply-chain risks.
• Hands‑on experience using AI-assisted development tools such as Claude Code, Cursor, or GitHub Copilot for security-related work, alongside a clear understanding of the risks associated with AI-generated code and agentic systems.
• Strong communication and stakeholder management skills, with the ability to explain technical risks and trade-offs to engineers, executives, regulators, and customers.
• Excellent judgment under pressure, including the ability to make timely, defensible decisions when information is incomplete.
• A collaborative leadership style that encourages secure engineering practices, empowers teams through practical guardrails, and balances risk management with delivery speed.
• Strong ownership, adaptability, mentoring skills, and the ability to work effectively across Engineering, Product, Infrastructure, Legal, Compliance, and Support.

Nice To Have

• Experience in fintech, payments, remittances, or cryptocurrency, particularly with cryptographic key management, custody operations, and blockchain security.
• Experience addressing fraud, account takeover, transaction abuse, and related financial security risks.
• Experience securing AI agents and production LLM systems, including prompt injection defenses, tool-permission models, security evaluations, and red‑teaming.
• Hands‑on offensive security experience, including penetration testing, red teaming, or managing bug bounty programs.
• Familiarity with cloud-native security tooling, including cloud security posture management (CSPM), runtime protection, and policy-as-code solutions such as OPA or Kyverno.
• Knowledge of regulatory requirements for money transmission and financial services across multiple jurisdictions.
• Relevant security certifications, such as CISSP, CISM, OSCP, or AWS Certified Security – Specialty.
• Experience supporting security due diligence for investors, prospective buyers, or enterprise customers.
• Experience establishing and scaling a security function within a fast-growing engineering organization.

Benefits

• Remote work: Fully remote opportunity within Brazil, offering flexibility and the ability to work in a distributed environment.
• Strategic ownership: Lead the security strategy for a financial technology platform operating in the cross-border payments ecosystem.
• Leadership opportunity: Build and scale a security function, develop a team, and establish security practices across engineering.
• Technical innovation: Work with cloud-native infrastructure, Kubernetes, microservices, blockchain integrations, and AI-assisted development technologies.
• Cross-functional collaboration: Partner with engineering leaders and teams across Product, Infrastructure, Risk, Legal, Compliance, and Support.
• Professional impact: Influence executive-level security decisions and help protect financial transactions, sensitive information, and critical systems.
• Continuous development: Shape security practices in emerging areas, including AI agents, LLM security, cloud security, and modern application protection.

How Jobgether Works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

We may use artificial intelligence (AI) tools to support parts of the hiring process, analyzing resumes and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.