Information Security Manager

Key Areas of Responsibilities

• Brazil License & Regulatory Compliance

Oversee the modification and implementation of changes to the global information security operational risk and ICT control framework required to support the application for and maintenance of the Brazilian VASP financial license under BCB Resolution 520/25. Coordinate with local legal representatives, external counsel, and regulatory authorities (including the Central Bank of Brazil) to ensure information security policies and operational resilience mechanisms remain fully compliant with Brazilian regulatory standards. Oversee the creation of the necessary technical controls, their implementation and continuous operation, including reporting and monitoring.

• Risk Identification and Assessment

Update and manage the information security operational risk register, ensuring accurate classification, measurement, and reporting of identified risks. Conduct regular operational ICT risk assessments across critical business processes, IT systems, and applications to identify control weaknesses and potential impact scenarios. Collaborate with business process owners to integrate ICT risk controls and ensure adherence to the 'three lines of defense' model. Integrate and monitor internal fraud controls specifically related to IT systems, processes, and privileged access, establishing necessary detection and prevention mechanisms.

• Audits and Compliance Management

Support internal and external audit processes, including collecting evidence, managing audit requests, and ensuring continuous compliance with regulatory standards.

• Risk Mitigation and Control Management

Design, implement, and monitor key risk indicators (KRIs) and key performance indicators (KPIs) for IT security controls and processes. Facilitate the control self-assessment process, verifying the existence and effectiveness of security controls across the organization.

• Investigations, Policies, and Training

Investigate and create comprehensive reports regarding fraud cases, security incidents, and privacy violations, ensuring timely follow-up on remediation measures. Conduct operational risk reviews of client processes and tools, presenting recommendations on identified security gaps and creating initiatives for fraud prevention. Develop new documents for Security Related Policies and update current policies. Create new documents for other departments related to Security or information security topics.