Senior Cyber Risk Specialist (Hybrid Or Remote)

iTRTech Group; São Paulo; Híbrido; BRL 180.000 - 240.000; Jornada completa

Descripción de la vacante

EY BR in Brazil is seeking a Senior Cyber Risk Specialist to support development and improvement of cyber risk management frameworks in a complex enterprise. The role focuses on identifying and monitoring cybersecurity risks and translating vulnerabilities into business actions.

The position offers hybrid or remote work options for candidates nationwide, with English required for international collaboration and interaction with global teams; seniority is 6+ years.

Formación

• Strong professional experience in Cyber Risk, Information Security Risk, Technology Risk, or related areas.
• Solid knowledge of Risk Management methodologies and cybersecurity risk assessment practices.
• Experience identifying and evaluating cybersecurity risk scenarios.
• Hands-on experience conducting inherent and residual risk assessments.
• Knowledge of security control design, effectiveness, and maturity assessments.
• Ability to translate technical vulnerabilities and security risks into business impacts and recommendations.
• Strong analytical, communication, and stakeholder management skills.
• Advanced or fluent English for communication in international environments.

Responsabilidades

• Support the development and improvement of Cyber Risk Management frameworks and methodologies.
• Identify, analyze, and assess cybersecurity risk scenarios, including inherent and residual risks.
• Evaluate the design, effectiveness, and maturity of security controls.
• Support Risk Acceptance, Exception Management, and Risk Treatment processes.
• Develop and monitor Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), Risk Registers, and dashboards.
• Conduct cyber risk assessments involving vendors and third-party providers.
• Collaborate with Technology, Privacy, Resilience, and Operational Risk teams.
• Facilitate stakeholder interviews and workshops, preparing risk reports and executive presentations.

Conocimientos

Cyber risk experience

Risk management methodologies

Cybersecurity risk assessment

Inherent & residual risk assessments

Security controls design & maturity

Translate vulnerabilities to business

Analytical & stakeholder management

English for international environments

Descripción del empleo

SENIOR CYBER RISK SPECIALIST (HYBRID OR REMOTE BRAZIL)

Company hires for hybrid or remote position

Location: Brazil — candidates from any region are welcome

Only candidates already based in Brazil will be considered

Work Model: Hybrid for candidates living in state capitals and Remote for candidates living in countryside/cities outside the state capitals

Language Requirements: Advanced or Fluent English

Seniority: Senior (6+ years)

Rate: Candidates should provide their salary expectations

About the Opportunity

We are looking for an experienced Senior Cyber Risk Specialist to support the development and continuous improvement of Cyber Risk Management frameworks and methodologies in a complex enterprise environment.

The professional will be responsible for identifying, assessing, and monitoring cybersecurity risks, evaluating security controls, and translating technical vulnerabilities into business impacts and actionable recommendations.

Responsibilities

• Support the development and improvement of Cyber Risk Management frameworks and methodologies.


• Identify, analyze, and assess cybersecurity risk scenarios, including inherent and residual risks.


• Evaluate the design, effectiveness, and maturity of security controls.


• Support Risk Acceptance, Exception Management, and Risk Treatment processes.


• Develop and monitor Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), Risk Registers, and dashboards.


• Conduct cyber risk assessments involving vendors and third-party providers.


• Collaborate with Technology, Privacy, Resilience, and Operational Risk teams.


• Facilitate stakeholder interviews and workshops, preparing risk reports and executive presentations.

Requirements

• Strong professional experience in Cyber Risk, Information Security Risk, Technology Risk, or related areas.


• Solid knowledge of Risk Management methodologies and cybersecurity risk assessment practices.


• Experience identifying and evaluating cybersecurity risk scenarios.


• Hands-on experience conducting inherent and residual risk assessments.


• Knowledge of security control design, effectiveness, and maturity assessments.


• Ability to translate technical vulnerabilities and security risks into business impacts and recommendations.


• Strong analytical, communication, and stakeholder management skills.


• Advanced or fluent English for communication in international environments.

Nice to Have

• Experience with Third-Party Risk Management or Vendor Cyber Risk assessments.


• Knowledge of Risk Acceptance, Exception Management, and Risk Treatment Plans.


• Experience with KRIs, KPIs, Risk Registers, and risk dashboards.


• Understanding of Technology Risk, Privacy Risk, Resilience, and Operational Risk.


• Certifications such as CRISC, CISSP, CISM, CISA, or ISO 27001-related certifications.

Ideal Candidate Profile

A Senior Cyber Risk Specialist with strong expertise in cybersecurity risk assessment, security control evaluation, and enterprise risk management. The ideal candidate demonstrates analytical thinking, business-oriented risk communication, and the ability to collaborate with technical teams, business stakeholders, and executive leadership in an international environment.

5 Questions for Candidates

1. How many years of professional experience do you have in Cyber Risk, Information Security Risk, or Technology Risk?


2. What is your experience conducting inherent and residual risk assessments and evaluating security controls?


3. Have you worked with Cyber Risk Management frameworks, Risk Acceptance, Exception Management, or Risk Treatment Plans?


4. What is your experience with Third-Party Cyber Risk, KRIs, KPIs, Risk Registers, and executive risk reporting?


5. What are your current salary, salary expectations, and availability to work in a hybrid or remote model in Brazil?

Keywords

Cyber Risk, Cyber Risk Management, Information Security Risk, Technology Risk, Cybersecurity, Risk Assessment, Inherent Risk, Residual Risk, Security Controls, Risk Management Framework, Third-Party Risk, Vendor Risk Management, Risk Acceptance, Exception Management, Risk Treatment, KRIs, KPIs, Risk Registers, Risk Dashboards, Operational Risk, Privacy Risk, Resilience, CRISC, CISSP, CISM, CISA, ISO 27001

#EY BR