Lead Security Engineer - GRC

The role

You will act as a senior technical and risk reference across TPRM, Security Awareness, and Cyber Risk. You will assess security gaps, build automation and policies, and partner with various teams to translate requirements into technical specifications.

What you will do

• Assess security gaps across business processes and technologies
• Define remediation plans with clear owners and deadlines
• Align with ITSec, Risk, and Procurement on risk mitigation and acceptance
• Lead the evolution of the TPRM program toward a risk-based lifecycle model
• Define and review security requirements for third parties
• Build and scale automation and AI-assisted assessment capabilities
• Report third-party risk posture and trends to leadership
• Drive human risk programs through phishing simulations, training, and communication
• Define and track behavior-change metrics through dashboards
• Act as technical lead across the squad to foster continuous improvement

Required qualifications

• Proven experience designing and implementing security controls and leading risk management initiatives
• Strong knowledge of domains and concepts of cyber risks
• Hands-on experience with risk identification, assessment and prioritization using qualitative and quantitative methods
• Experience with TPRM (third-party risk management)
• Experience building or running security awareness and human-risk programs, or a strong ability to ramp up on them quickly
• Experience with large-scale distributed environments and cloud environments (e.g. AWS, GCP, Azure)
• Familiarity with frameworks such as NIST CSF, NIST SP 800-30, ISO 27001/27002/27005, ISO 31000, PCI-DSS, ITIL, COBIT and similar
• Excellent executive communication skills
• Technical background and comfort with automation, scripting and AI or LLM-based tooling
• Experience operating in regulated and global environments, including interaction with auditors and regulators
• Proven ability to lead projects and process improvement initiatives, and to mentor other engineers and analysts
• Advanced English proficiency, written and spoken

Nice to have

• Bachelor’s degree in Engineering, Technology, Information Security, Risk Management or related fields
• Certifications such as PCI ISA or PCIP, CISA, CISM or CISSP
• Experience in a regulated fintech, financial services environment or consulting roles
• Experience in AI risk: assessing risks of generative AI and LLM use cases

Benefits

• Chance of earning equity at Nubank
• Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
• Public Transportation Commuting Benefit (Vale-Transporte)
• NuCare – Psychological, Financial and Legal Assistance Program
• Life Insurance
• Medical Plan
• Dental Plan
• NuLanguage – Language Course Program
• Nucleo - Our learning platform of courses
• Extended Parental Leave
• Daycare Allowance
• Parental Consultancy

Before you apply

• Recruitment process may involve the use of artificial intelligence–enabled tools
• Nu does not provide individualized technical feedback

About the company

Nu serves more than 140 million customers with a mission to fight complexity and empower people. The company uses proprietary technology and data at scale to power its digital platform.