Lead Security Engineer - GRC
Nubank
A complete application in a minute
Tailored resume and cover letter, ready to send.
Benefits offered by this job
Job summary
Nubank is seeking a Lead Security Engineer to guide risk management across TPRM, Security Awareness, and Cyber Risk for Brazil, Mexico, Colombia and more. You will translate requirements into actionable technical specs and partner with Engineering, Legal, Procurement, and Risk teams to scale programs globally.
The role emphasizes designing security controls, leading risk initiatives, and building automation to reduce manual work while coordinating with senior leadership on risk posture and
Qualifications
- Proven experience designing and implementing security controls and leading risk management initiatives.
- Hands-on risk analysis using qualitative and quantitative methods.
- Experience with TPRM and security awareness programs.
- Cloud experience (AWS, GCP, Azure) and large-scale distributed environments.
- Familiarity with security frameworks and regulatory interactions.
- Strong executive communication for leadership and committees.
- Automation scripting and AI/LLM tooling to scale security processes.
- Experience in regulated/global environments and mentoring engineers.
Responsibilities
- Assess security gaps across processes and technologies and define remediation plans with owners.
- Align mitigations with ITSec, Risk, and Procurement stakeholders.
- Lead evolution of TPRM toward lifecycle-based model (onboarding, monitoring, offboarding, fourth-party).
- Define security requirements for third parties and guide business owners on application.
- Scale automation and AI-assisted assessment capabilities to increase coverage.
- Report third-party risk posture and trends to leadership and committees.
- Drive human risk programs through phishing simulations and training, evolving tooling.
- Define and track behavior-change metrics and present dashboards for management.
- Act as technical lead, raising bar and mentoring engineers.
Skills
Education
Tools
Job description
Nu serves more than 140 million customers, guided by a mission to fight complexity and empower people. The company has been leading an industry transformation through innovative products and human-centered services.
Proprietary technology and data at scale power Nu's digital platform, built to promote financial access, advancement, and transparency. Its business model thrives on customer love and lower costs, feeding a flywheel of growth and profitability.
Visit our Institutional Page
As a Lead Security Engineer you will be a senior technical and risk reference who moves where the risk is, across TPRM, Security Awareness and Cyber Risk, rather than owning a single silo. You will assess security gaps across diverse technologies, third parties and business contexts, quantify what matters, and turn it into prioritized, actionable treatment plans that leadership can decide on.
You will build and evolve the policies, methodologies, platforms and automation behind these programs, and help the squad scale across Brazil, Mexico, Colombia, and other geos without scaling headcount linearly. You will partner with Engineering, Product, Legal, Procurement, Operations, Internal Communication, Risk teams and the business stakeholders to translate requirements into clear, pragmatic technical specifications. This is a multidisciplinary and global role, working with teams primarily based in Brazil, Mexico, Colombia, and the United States.
- Assess security gaps across business processes and technologies, enable effective risk treatment, and define remediation plans with clear owners and deadlines.
- Work closely with ITSec, Risk, Procurement stakeholders to align on mitigation of identified risks and on risk acceptance decisions.
- Lead the evolution of the TPRM program toward a risk-based, lifecycle model: onboarding, continuous monitoring, offboarding, and fourth-party visibility.
- Define/review security requirements for third parties, including contractual security clauses and annexes, and guide business owners on their application.
- Build and scale automation and AI-assisted assessment capabilities that reduce manual questionnaire effort and increase coverage.
- Report third-party risk posture and trends to leadership and relevant committees.
- Drive human risk programs through phishing simulations, training and communication and evaluate and evolve the tooling behind them (build versus buy).
- Define and track behavior-change metrics that go beyond completion rates, and report them through dashboards for management.
- Act as technical lead across the squad, raising the technical and analytical bar and fostering continuous improvement.
- Proven experience designing and implementing security controls and leading risk management initiatives, with strong knowledge of domains and concepts of cyber risks.
- Hands-on experience with risk analysis techniques: risk identification, assessment and prioritization, using both qualitative and quantitative methods.
- Experience with TPRM (third-party risk management).
- Experience building or running security awareness and human-risk programs, or a strong ability to ramp up on them quickly.
- Experience with large-scale distributed environments and cloud environments (e.g. AWS, GCP, Azure).
- Familiarity with frameworks such as NIST CSF, NIST SP 800-30, ISO 27001/27002/27005, ISO 31000, PCI-DSS, ITIL, COBIT and similar.
- Excellent executive communication skills, able to translate complex topics into clear, actionable insights for senior leadership and committees.
- Technical background and comfort with automation, scripting and AI or LLM-based tooling to scale security processes.
- Experience operating in regulated and global environments, including interaction with auditors and regulators.
- Proven ability to lead projects and process improvement initiatives, and to mentor other engineers and analysts.
- Advanced English proficiency, written and spoken. Spanish is a plus.
- Bachelor's degree in Engineering, Technology, Information Security, Risk Management or related fields.
- Certifications such as PCI ISA or PCIP, CISA, CISM or CISSP.
- Experience in a regulated fintech, financial services environment or consulting roles.
- Experience with AI risk: assessing risks of generative AI and LLM use cases (data leakage, prompt injection, model and vendor risk)
São Paulo, Brazil
Campinas, Brazil
Rio de Janeiro, Brazil
Belo Horizonte, Brazil
- Chance of earning equity at Nubank
- Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
- Public Transportation Commuting Benefit (Vale-Transporte)
- NuCare - Psychological, Financial and Legal Assistance Program
- Life Insurance
- Medical Plan
- Dental Plan
- NuLanguage - Language Course Program
- Nucleo - Our learning platform of courses
- Extended Parental Leave
- Daycare Allowance
- Parental Consultancy
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
