IT Security & Compliance Lead (São Paulo, Brasil)

B Lab; São Paulo; Remote; BRL 213,000 - 261,000; Full time

Benefits offered by this job

Remote-first workplace

Home office stipend

Monthly food allowance

Health insurance reimbursement

Professional development time off

Job summary

B Lab is seeking an IT Security & Compliance Lead to own security governance across the global network. You will conduct audits, set baselines, and drive security maturity with regional teams and product/engineering groups.

You'll implement policies, manage incident response, and support data protection compliance (GDPR, LGPD) across regions. This is a remote-first, full-time CLT role based in São Paulo, Brazil, with in-person onboarding and a strong focus on security risk management.

Qualifications

• 3+ years of information security, IT governance, risk and compliance (GRC).
• Strong networking, cybersecurity and regulatory compliance knowledge.
• Experience with at least one recognized cybersecurity framework.
• Experience conducting security audits, risk assessments and vendor security reviews.
• Knowledge of data protection regulations (GDPR, LGPD).
• Experience developing incident response and business continuity plans.
• Hands-on with cloud and SaaS security; Google Workspace admin and IAM.
• Ability to explain risk clearly and write clear policies.

Responsibilities

• Own security governance, audits, and risk assessments across the network.
• Define and maintain security baselines aligned to a framework (ISO/IEC 27001).
• Track posture with metrics and report to Technology leadership.
• Coordinate external penetration testing and vulnerability remediation.
• Define access controls (MFA, SSO, least privilege) across Google Workspace and Salesforce.
• Lead incident response coordination with Legal, Communications and regions.
• Support data protection compliance across GDPR, LGPD and Brazil.
• Maintain and update the security policy set and staff awareness program.

Skills

GRC experience

Security auditing

Risk assessment

Cloud security

Zero-trust

Workspace admin

IAM

Policy development

Vendor security review

Tools

KnowBe4

Google Vault

Salesforce security

Job description

Please Note: B Lab is not working with a third party to fill this role an no part of our process requires applicants to pay fees. Applicants should only use our job board to submit an application, and will interact directly with our team during this process.

About the Opportunity

B Lab is seeking an IT Security & Compliance Lead to own security governance across the global network. Consolidation increases security exposure as organizations with different controls come together, and this role exists to set a consistent baseline and raise our security posture proactively rather than reactively.

The Lead conducts security audits and risk assessments, sets and enforces baseline security standards, maintains our information security policy set, coordinates incident response, and supports data protection compliance in the jurisdictions where B Lab operates. Working closely with the Senior Manager of Infrastructure & Information Management, the Regional IT Administrators, and the product, engineering and data teams (including the Data Governance Lead), this role drives consistent security maturity across the network's systems and helps people across the network work securely.

Core Responsibilities

Security Governance, Audits, and Assessments

• Conduct regular security audits and risk assessments of network systems, applications and processes, and maintain a prioritized risk register
• Establish and maintain a security baseline across the network, aligned to a recognized framework (for example ISO/IEC 27001:2022)
• Track and report security posture and maturity over time to the Technology leadership team, with clear metrics
• Run security reviews of new and existing vendors and technology platforms (third-party risk), including SaaS tools used by regional and market teams
• Coordinate external penetration testing and vulnerability scanning, and track remediation with system owners

Identity, access and platform security

• Define and monitor access control standards (MFA, SSO, least privilege, joiner/mover/leaver processes) across core platforms such as Google Workspace and Salesforce
• Partner with Regional IT Administrators on endpoint and device security standards for a distributed, remote-first workforce, moving toward a zero-trust model
• Advise Product & Platform Engineering on secure-by-design practices for B Lab's digital

Security policy development and awareness

• Own and maintain the information security policy set (including the Information Security, Backup & Recovery and Security Incident Management policies) and the standards and procedures that support it
• Refine policies as the network consolidates, and communicate changes clearly to staff across regions and languages
• Own the network-wide security awareness program (KnowBe4), including training, phishing simulations and completion reporting
• Contribute the security perspective to the B Lab AI Policy and to the safe adoption of AI tools

Incident response and resilience

• Own and maintain the incident response plan, covering detection, escalation, containment, communication and post-incident review
• Serve as lead coordinator during security incidents, working with Legal, Communications and affected regions
• Support business continuity and disaster recovery planning, including testing backup and recovery procedures

Compliance and risk management support

• Support data protection compliance across the regions where B Lab operates (for example GDPR, UK GDPR and Brazil's LGPD), in partnership with Legal and the Data Governance Lead
• Partner with Legal, HR, Finance and other teams on compliance matters, such as data processing agreements, data subject requests and breach notification
• Maintain documentation and evidence that supports audits, partner and funder due diligence, and regulatory inquiries

About You

• 3+ years of experience in information security, IT governance, risk and compliance (GRC), or a closely related field
• Strong understanding of networking concepts, cybersecurity, and implementing best practices to ensure compliance with data and regulatory tech laws.
• Strong understanding of at least one recognized cybersecurity framework
• Experience conducting security audits, risk assessments and vendor security reviews
• Working knowledge of data protection regulations relevant to a global organization (for example GDPR, LGPD)
• Experience developing or maintaining incident response and business continuity plans
• Hands-on familiarity with cloud and SaaS security, especially Google Workspace administration and identity and access management
• Ability to explain security risk in plain language to non-technical colleagues, and to write clear policies

The following is not strictly required but would allow you to thrive in this role:

• Experience in a nonprofit, federated or multi-entity organization, or in integrating security controls after a merger or consolidation
• Experience with Salesforce security, security awareness platforms (such as KnowBe4), or endpoint management tools
• Experience with Google Vault or similar eDiscovery and data retention tools
• Consider themselves a relentless problem solver, with a collaborative style and a systems-thinking approach
• Be ready to take on growing challenges in a complex, global organization
• Have a positive outlook, and a consistent and positive manner working with others
• Have a strong desire to learn, improve and apply
• Know when to drive a workstream independently
• Know when to recommend outside resources, and how to advise leadership on technology and security strategy

Major objectives for the role in the first 6-12 months

• Perform a network-wide risk assessment: assess the security posture of B Lab and consolidating entities, identify gaps, and produce a prioritized risk register and roadmap.
• Establish and enforce a security baseline: using the assessment, define a clear baseline (identity, devices, data, vendors) and drive implementation with the Regional IT Administrators to close the highest-priority gaps.
• Refresh the policy set: review and update the information security policies so they apply to the consolidated network, and get them approved and communicated.
• Build a security awareness and incident response culture: take ownership of KnowBe4, run training and phishing simulations, and publish an incident response plan so staff know how to report threats and the technology team has a defined remediation process.

Compensation Details

B Lab has a compensation plan that includes:

• A yearly salary in the range of R$212,960 - R$261,030 (not including the 13th salary)
• Sick & other leave in accordance with Brazilian statutory leave allowance
• Company provided laptop

We also offer other benefits that are based on company policy and are not included in your contract and therefore are subject to change or addition as our organization works to support our staff.

• Paid time off during organization-wide closures for wellness
• Professional Development and time off: 40 hours paid time off with access to professional development after 1 year of service
• Paid time off for volunteering - after one year of service
• One time home office set-up allowance
• Additional perks you may qualify for: monthly home office allowance, monthly food allowance & monthly health insurance reimbursement
• Remote-first workplace

This will be a CLT contract. This is a Full-Time Role (40 hours per week, 5DWW) with no option for part-time work.

This job ad is for São Paulo, Brazil. While this is a remote-first opportunity, the candidate filling this role must hold Brazilian work authorization without any time limitations or any other restrictions, and they must be a resident of Brazil at the start of employment. Additionally, they must be within commuting distance of São Paulo. If you wish to be based in one of our other locations listed for this role, please visit our Careers page and submit your application through the job ad that best fits with where you hold residency and work authorization.

Hiring Process

Please note that your first day of work must be in-person at one of our office locations to complete onboarding documents and meet with some members of our team.

Please note: This job ad will close automatically at 9:00AM EST on October 27th. Due to capacity constraints on our hiring team, we are unable to provide you with a specific status update beyond these parameters but all candidates will hear back via e-mail once we have completed or review of applications. Our ideal start date for this role is December 1, 2026.