Senior Security Engineer - GRC (PCI)

VulnU; São Paulo, Campinas, Rio de Janeiro, Belo Horizonte; Hybrid; BRL 180,000 - 280,000; Full time

Benefits offered by this job

Equity

Paid parental leave

30 days PTO

Home-office stipend

Retirement match

Food/Meal card

Job summary

Nubank is seeking a Senior Security Engineer specializing in GRC and PCI to support certification programs across Brazil. You will coordinate audits, interpret requirements, and partner with product and engineering teams to embed controls into systems and processes.

The role emphasizes cross-country collaboration, cloud controls, and continuous improvement in compliance practices within a fast-growing fintech environment.

Qualifications

• Strong knowledge of PCI DSS, SOC2, and similar standards.
• Experience leading security certification or audit programs.

Responsibilities

• Provide operational support and act as focal point for assigned certification scope.
• Interpret requirements and coordinate recurring tests required by certification.
• Register and track action plans from audits and findings.
• Collaborate with engineering and product teams to embed compliance into processes.

Skills

PCI DSS

SOC 2

NIST

Cloud security

Audit & controls

Risk assessment

Security automation

Communication

Education

Bachelor's degree in CS/IS

Certifications (PCI ISA/PCIP, CISA, CISM, CISSP)

Tools

AWS

GCP

Azure

CI/CD tools

Job description

# Senior Security Engineer - GRC (PCI)Nubank · nubank.com.brCategory: GRC & ComplianceLocation: RemoteLevel: Senior## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* Paid parental leave* 30 days PTO* Home-office stipend* Equity* Retirement matchAbout NuNu serves more than 140 million customers, guided by a mission to fight complexity and empower people. The company has been leading an industry transformation through innovative products and human-centered services. Proprietary technology and data at scale power Nu’s digital platform, built to promote financial access, advancement, and transparency. Its business model thrives on customer love and lower costs, feeding a flywheel of growth and profitability.Visit our Institutional PageAbout the roleThe Governance, Risk and Compliance (GRC) team enables Nubank to remain compliant with legal, regulatory, and internal requirements, while continuously identifying, classifying, and monitoring risks and providing strategic insights and performance evaluation to leadership. We collaborate with multidisciplinary teams to align our technology security strategy with Nubank’s overall business objectives, embedding security in business decisions so that Nubank can grow safely.We make sure identified risks are mitigated and that leaders, inside and outside the IT and Security Business Unit, can make decisions based on risk. The focus of the security compliance squad is to ensure Nubank complies with regulations across countries and entities, and holds PCI DSS certifications, alongside other frameworks.You will be responsible forProvide operational support and act as a focal point for the assigned certification scope.Interpret certification requirements applicable to your scope and execute and coordinate recurring tests required by the certification.Register, manage, and track action plans arising from audit findings or identified gaps.Maintain a day-to-day interface with audited and external teams on control implementation, scope alignment, evidence collection, and deadline agreement.Propose and implement improvements in internal certification processes.Build and maintain strong partnerships with product, engineering and IT teams to make audits and assessments smoother and less disruptive.Collaborate with Engineering, Product, IT and global teams to integrate compliance requirements into processes and systems.We are looking for a person who hasSolid knowledge across cybersecurity domains and frameworks such as PCI DSS, SOC2, DORA, NIST and similar standards.Prior experience supporting security certification or audit processes, including end-to-end management, scoping, and evidence collection.Experience with internal controls, compliance functions, and action plans follow up arising from audit findings or identified gaps.Experience evaluating and implementing controls in cloud environments (for example AWS, GCP, Azure).Strong analytical skills to interpret complex data and turn findings into actionable insights.Strong communication skills to translate complex technical concepts.Comfort using AI and automation as the default way of working, while validating outputs critically.Advanced English, written and spoken, for work with global teams and external assessors. Spanish is a plus.Nice to haveCertifications such as PCI ISA or PCIP, CISA, CISM or CISSP.Experience in a regulated fintech or financial services environment.Experience with multi country or multi entity certification programs.Location for this opportunity (City, Country)São Paulo, BrazilCampinas, BrazilRio de Janeiro, BrazilBelo Horizonte, BrazilBenefitsChance of earning equity at NubankFood/ Meal Card (Vale-Refeição and/or Vale Alimentação)Public Transportation Commuting Benefit (Vale-Transporte)NuCare – Psychological, Financial and Legal Assistance ProgramLife InsuranceMedical PlanDental PlanNuLanguage – Language Course ProgramNucleo - Our learning platform of coursesExtended Parental LeaveDaycare AllowanceParental ConsultancyWork-from-home AllowanceGym Partnerships30 days of paid vacationRelocation Assistance Package, if applicableWork Model for this RoleHybrid 2-3 times/week: Our hybrid work model brings us to the office at least twice a week, on strategic days designed to maximize team connection and collaboration. For more details, visit https://building.nubank.com/nu-hybrid-work-model/Our recruitment process may involve the use of artificial intelligence–enabled tools, such as automated interview transcription and analysis, to support the evaluation process. Artificial intelligence is not used to make final hiring decisions; all decisions are made by human reviewers.To maintain a consistent and fair process for every candidate, Nu does not provide individualized technical feedback. See how our policy works here