Information Security Analyst

ONErpm; Rio de Janeiro; On-site; BRL 180,000 - 300,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Meal allowance (groceries)

Meal allowance (restaurants)

Life insurance

TotalPass

Birthday Day Off

Job summary

ONErpm is seeking a senior security engineer in Rio de Janeiro to embed security by design into product development and drive privacy compliance. You will implement automated security tooling in CI/CD pipelines, assess cloud infrastructure, and coordinate regular pentests.

In this role you will manage incident response, risk assessments, and vendor risk while promoting security awareness across the organization, aligning with CIS Controls and OWASP Top 10.

Qualifications

• Bachelor's degree in a technology field as listed.
• Experience with SAST/DAST/SCA tools in CI/CD pipelines.
• Knowledge of OWASP Top 10, CIS Controls and LGPD compliance.

Responsibilities

• Security by Design: incorporate security requirements early in system design.
• Automated tooling: deploy and maintain SAST/DAST/SCA in CI/CD pipelines.
• Cloud security posture: monitor and improve cloud environments against benchmarks.
• Privacy & LGPD: map data flows and assess privacy risks in new features.
• Pentesting coordination: manage external/internal pentests and remediation.
• Vendor risk: assess third parties and monitor security of tools/services.
• Security awareness: run training, phishing simulations, and culture initiatives.
• Incident management: detect, respond, and investigate security incidents.
• Audit responses: support due diligence and regulatory audits.

Skills

Security best practices

Threat modeling

Incident response

Security communication

Education

Bachelor's degree in Information Security, Computer Science, Software Engineering, Systems Analysis, or related technology fields

Tools

SAST

DAST

SCA

GitHub Actions

GitLab CI

Azure DevOps

Job description

ONErpm strives to establish its legacy as a global brand that makes an impact on the artistic community, the music business, and society as a whole. We are an inclusive company driven by innovation, music, and technology. We believe in mutual respect and recognize that different perspectives drive innovation, accelerate growth, and lead to more sustainable decisions and results.

If you join us, regardless of your location or position, we will support you in doing your best and reaching your full potential.

As a pioneering company, ONErpm has captured more than 20% of Brazil's digital music market in less than 16 years. Today, we operate in Mexico, the United States, Colombia, Argentina, Peru, Chile, Jamaica, Spain, Nigeria, Vietnam, and many other countries.

As of May 2026, ONErpm has more than 46 offices across 32 countries, with a presence on nearly every continent.

Responsibilities

About ONErpm

ONErpm strives to establish its legacy as a global brand that makes an impact on the artistic community, the music business, and society as a whole. We are an inclusive company driven by innovation, music, and technology. We believe in mutual respect and recognize that different perspectives drive innovation, accelerate growth, and lead to more sustainable decisions and results.

If you join us, regardless of your location or position, we will support you in doing your best and reaching your full potential.

As a pioneering company, ONErpm has captured more than 20% of Brazil's digital music market in less than 16 years. Today, we operate in Mexico, the United States, Colombia, Argentina, Peru, Chile, Jamaica, Spain, Nigeria, Vietnam, and many other countries.

As of May 2026, ONErpm has more than 46 offices across 32 countries, with a presence on nearly every continent.

Responsibilities

• Security in Design: Integrate security requirements and perform threat modeling/project risk analyses in the early stages of system design and feature development (Security by Design)
• Pipeline & Code Security (AppSec): Implement, operate, and maintain automated security tooling (SAST, DAST, SCA) in CI/CD pipelines; assist software engineers in remediating vulnerabilities using OWASP Top 10 guidelines and secure coding frameworks.
• Cloud Security Posture: Evaluate, monitor, and improve the security posture of cloud infrastructure and technology environments based on recognized benchmarks such as CIS Controls and cloud security best practices.
• Privacy & LGPD Compliance: Establish and manage operational workflows for data subject access requests (DSARs), maintain the continuous data mapping lifecycle, and evaluate privacy risks in new product features.
• Penetration Testing Coordination: Coordinate regular external/internal pentesting procedures, including environment provisioning, scoping requirements between vendors and internal development teams, and managing remediation tracking.
• Vendor & Third-Party Risk Management: Implement and oversee IT vendor security assessments to evaluate and mitigate the aggregate risks introduced by third-party tools, services, and partners.
• Security Awareness & Culture: Plan and execute continuous security awareness programs, phishing simulations, and training sessions to build a proactive security mindset across the organization.
• Incident Management & Root Cause Analysis: Monitor, respond to, and investigate information security and privacy incidents, analyzing root causes and implementing preventative controls.
• Due Diligence & Audit Response: Conduct and respond to security and privacy due diligence assessments from customers, vendors, and regulatory auditors
• Metrics & Indicators: Develop, track, and report Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for Information Security and Privacy maturit
• Compliance & Regulations: Ensure adherence to internal company policies, compliance regulations, industry standards, and workplace health and safety rules pertinent to the position.

Requirements

• Higher Degree (Bachelor's) in Information Security, Computer Science, Software Engineering, Systems Analysis, or related technology fields.
• Desirable Certifications: CompTIA Security+, AWS/Azure Security Specialty, Certified AppSec Practitioner (CAP), EXIN Privacy & Data Protection (LGPD/GDPR), or ISO 27001 Lead Implementer/Auditor.
• Proficiency in SAST, DAST, and SCA tools and their integration into CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Azure DevOps).
• Solid understanding of the OWASP Top 10, CIS Controls, and cloud security architecture (AWS, GCP, or Azure).
• In-depth knowledge of the General Data Protection Law (LGPD), data mapping, and DSAR management workflows.
• Familiarity with third-party risk management (TPRM) frameworks and pentest scoping/vendor management.
• Solid fundamentals in networking, protocols, identity and access management (IAM), and technology infrastructure.

Benefits

• Health and Dental Insurance

• Meal Allowance (Groceries)

• Meal Allowance (Restaurants)

• Life Insurance

• TotalPass

• Birthday Day Off