Information Security Analyst

ONErpm; Brasil; A distancia; BRL 180.000 - 300.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health and Dental Insurance

Meal Allowance (Groceries)

Meal Allowance (Restaurants)

Life Insurance

TotalPass

Birthday Day Off

Descripción de la vacante

ONErpm is seeking a Security Engineer in Brazil to design and enforce secure-by-design practices across software systems. You will implement automated security tooling in CI/CD, strengthen cloud security postures, and ensure LGPD/privacy compliance while managing DSAR workflows and audit readiness.

The role requires hands-on expertise with SAST/DAST/SCA, OWASP Top 10, and vendor risk management. Strong networking and IAM fundamentals are essential for guarding complex environments.

Formación

• Bachelor's degree in information security or related field.
• Proficiency with SAST/DAST/SCA tools and CI/CD integration.
• Strong knowledge of OWASP Top 10 and cloud security architecture.
• Experience with LGPD/GDPR privacy requirements and data mapping.
• Familiarity with vendor risk management and pentest scoping.
• Solid networking, IAM, and infrastructure fundamentals.

Responsabilidades

• Design and implement secure by design practices for software systems.
• Operate and maintain automated security tooling in CI/CD pipelines.
• Evaluate and improve cloud security posture using CIS controls.
• Manage DSAR workflows and privacy risk assessments.
• Coordinate pentesting and remediation tracking.
• Oversee third-party risk and vendor security assessments.
• Lead security awareness initiatives and incident response.
• Support audits and regulatory due diligence.
• Develop KPIs and KRIs for information security maturity.
• Ensure compliance with internal policies and privacy laws.

Conocimientos

SAST

DAST

SCA

OWASP Top 10

Cloud Security

DSAR Management

Vendor Risk

Educación

Bachelor's degree in Information Security

Bachelor's degree in Computer Science

Herramientas

GitHub Actions

GitLab CI

Azure DevOps

Descripción del empleo

About ONErpm

ONErpm strives to establish its legacy as a global brand that makes an impact on the artistic community, the music business, and society as a whole. We are an inclusive company driven by innovation, music, and technology. We believe in mutual respect and recognize that different perspectives drive innovation, accelerate growth, and lead to more sustainable decisions and results.

If you join us, regardless of your location or position, we will support you in doing your best and reaching your full potential.

As a pioneering company, ONErpm has captured more than 20% of Brazil’s digital music market in less than 16 years. Today, we operate in Mexico, the United States, Colombia, Argentina, Peru, Chile, Jamaica, Spain, Nigeria, Vietnam, and many other countries.

As of May 2026, ONErpm has more than 46 offices across 32 countries, with a presence on nearly every continent.

Responsibilities

• Security in Design: Integrate security requirements and perform threat modeling/project risk analyses in the early stages of system design and feature development (Security by Design)
• Pipeline & Code Security (AppSec): Implement, operate, and maintain automated security tooling (SAST, DAST, SCA) in CI/CD pipelines; assist software engineers in remediating vulnerabilities using OWASP Top 10 guidelines and secure coding frameworks.
• Cloud Security Posture: Evaluate, monitor, and improve the security posture of cloud infrastructure and technology environments based on recognized benchmarks such as CIS Controls and cloud security best practices.
• Privacy & LGPD Compliance: Establish and manage operational workflows for data subject access requests (DSARs), maintain the continuous data mapping lifecycle, and evaluate privacy risks in new product features.
• Penetration Testing Coordination: Coordinate regular external/internal pentesting procedures, including environment provisioning, scoping requirements between vendors and internal development teams, and managing remediation tracking.
• Vendor & Third-Party Risk Management: Implement and oversee IT vendor security assessments to evaluate and mitigate the aggregate risks introduced by third-party tools, services, and partners.
• Security Awareness & Culture: Plan and execute continuous security awareness programs, phishing simulations, and training sessions to build a proactive security mindset across the organization.
• Incident Management & Root Cause Analysis: Monitor, respond to, and investigate information security and privacy incidents, analyzing root causes and implementing preventative controls.
• Due Diligence & Audit Response: Conduct and respond to security and privacy due diligence assessments from customers, vendors, and regulatory auditors
• Metrics & Indicators: Develop, track, and report Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for Information Security and Privacy maturit
• Compliance & Regulations: Ensure adherence to internal company policies, compliance regulations, industry standards, and workplace health and safety rules pertinent to the position.

Requirements

• Higher Degree (Bachelor’s) in Information Security, Computer Science, Software Engineering, Systems Analysis, or related technology fields.
• Desirable Certifications: CompTIA Security+, AWS/Azure Security Specialty, Certified AppSec Practitioner (CAP), EXIN Privacy & Data Protection (LGPD/GDPR), or ISO 27001 Lead Implementer/Auditor.
• Proficiency in SAST, DAST, and SCA tools and their integration into CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Azure DevOps).
• Solid understanding of the OWASP Top 10, CIS Controls, and cloud security architecture (AWS, GCP, or Azure).
• In-depth knowledge of the General Data Protection Law (LGPD), data mapping, and DSAR management workflows.
• Familiarity with third-party risk management (TPRM) frameworks and pentest scoping/vendor management.
• Solid fundamentals in networking, protocols, identity and access management (IAM), and technology infrastructure.

Benefits

• Health and Dental Insurance

• Meal Allowance (Groceries)
• Meal Allowance (Restaurants)
• Life Insurance
• TotalPass
• Birthday Day Off