Information Security Analyst

ONErpm; Conservatória; On-site; BRL 180,000 - 240,000; Full time

Benefits offered by this job

Health and Dental Insurance

Meal Allowance (Groceries)

Meal Allowance (Restaurants)

Life Insurance

TotalPass

Birthday Day Off

Job summary

ONErpm is seeking a senior security engineer to embed security in design, orchestrate CI/CD security tooling, and oversee cloud posture and data privacy programs. You will coordinate pentests, vendor risk, and security training across global teams.

The role focuses on threat modeling, incident response, and LGPD/GDPR compliance, with hands-on experience in SAST/DAST/SCA tools and cloud environments (AWS/GCP/Azure).

Qualifications

• Bachelor's degree in Information Security or related field is required.
• Strong knowledge of OWASP Top 10 and cloud security basics.
• Experience with CI/CD security tooling integration (GitHub Actions, GitLab CI, Azure DevOps).

Responsibilities

• Security in Design: model threats early in system design.
• Pipeline & Code Security: integrate SAST/DAST/ SCA in CI/CD.
• Cloud Security Posture: monitor and improve cloud security.
• Privacy & LGPD compliance: manage DSARs and data mapping.
• Penetration testing coordination with vendors and teams.
• Vendor risk management for third-party tools and services.
• Security awareness programs and phishing simulations.
• Incident management and root cause analysis.
• Due diligence and audit response for customers and regulators.
• KPIs and KRIs for information security and privacy maturities.
• Ensure compliance with internal policies and safety rules.

Skills

Threat modeling

Incident response

Security by design

Education

Bachelor's degree in Information Security

Tools

SAST tools

DAST tools

SCA tools

Job description

About ONErpm

ONErpm strives to establish its legacy as a global brand that makes an impact on the artistic community, the music business, and society as a whole. We are an inclusive company driven by innovation, music, and technology. We believe in mutual respect and recognize that different perspectives drive innovation, accelerate growth, and lead to more sustainable decisions and results.

If you join us, regardless of your location or position, we will support you in doing your best and reaching your full potential.

As a pioneering company, ONErpm has captured more than 20% of Brazil's digital music market in less than 16 years. Today, we operate in Mexico, the United States, Colombia, Argentina, Peru, Chile, Jamaica, Spain, Nigeria, Vietnam, and many other countries.

As of May 2026, ONErpm has more than 46 offices across 32 countries, with a presence on nearly every continent.

Responsibilities

• Security in Design: Integrate security requirements and perform threat modeling/project risk analyses in the early stages of system design and feature development (Security by Design)


• Pipeline & Code Security (AppSec): Implement, operate, and maintain automated security tooling (SAST, DAST, SCA) in CI/CD pipelines; assist software engineers in remediating vulnerabilities using OWASP Top 10 guidelines and secure coding frameworks.


• Cloud Security Posture: Evaluate, monitor, and improve the security posture of cloud infrastructure and technology environments based on recognized benchmarks such as CIS Controls and cloud security best practices.


• Privacy & LGPD Compliance: Establish and manage operational workflows for data subject access requests (DSARs), maintain the continuous data mapping lifecycle, and evaluate privacy risks in new product features.


• Penetration Testing Coordination: Coordinate regular external/internal pentesting procedures, including environment provisioning, scoping requirements between vendors and internal development teams, and managing remediation tracking.


• Vendor & Third-Party Risk Management: Implement and oversee IT vendor security assessments to evaluate and mitigate the aggregate risks introduced by third-party tools, services, and partners.


• Security Awareness & Culture: Plan and execute continuous security awareness programs, phishing simulations, and training sessions to build a proactive security mindset across the organization.


• Incident Management & Root Cause Analysis: Monitor, respond to, and investigate information security and privacy incidents, analyzing root causes and implementing preventative controls.


• Due Diligence & Audit Response: Conduct and respond to security and privacy due diligence assessments from customers, vendors, and regulatory auditors


• Metrics & Indicators: Develop, track, and report Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for Information Security and Privacy maturit


• Compliance & Regulations: Ensure adherence to internal company policies, compliance regulations, industry standards, and workplace health and safety rules pertinent to the position.

Requirements

• Higher Degree (Bachelor's) in Information Security, Computer Science, Software Engineering, Systems Analysis, or related technology fields.


• Desirable Certifications: CompTIA Security+, AWS/Azure Security Specialty, Certified AppSec Practitioner (CAP), EXIN Privacy & Data Protection (LGPD/GDPR), or ISO 27001 Lead Implementer/Auditor.


• Proficiency in SAST, DAST, and SCA tools and their integration into CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Azure DevOps).


• Solid understanding of the OWASP Top 10, CIS Controls, and cloud security architecture (AWS, GCP, or Azure).


• In-depth knowledge of the General Data Protection Law (LGPD), data mapping, and DSAR management workflows.


• Familiarity with third-party risk management (TPRM) frameworks and pentest scoping/vendor management.


• Solid fundamentals in networking, protocols, identity and access management (IAM), and technology infrastructure.

Benefits

• Health and Dental Insurance

• Meal Allowance (Groceries)


• Meal Allowance (Restaurants)


• Life Insurance


• TotalPass


• Birthday Day Off