Staff GRC Program Manager

About the role

As a Staff GRC Program Manager at Ripple, you will lead efforts in cybersecurity governance, risk management, and compliance, focusing on the Brazilian market. You will collaborate with local leadership and global InfoSec teams to ensure adherence to regulatory frameworks and maintain security standards for Ripple's operations.

Success in this role requires a deep understanding of the Brazilian financial landscape and experience with various information security frameworks. You will be responsible for preparing updates for local management and the board, conducting technical control testing, and managing relationships with outsourced service providers.

Skills that matter here

• information security: This role involves leading the information security program and ensuring compliance with local regulations.
• risk management: You will assess and manage cybersecurity risks in relation to regulatory requirements.
• compliance: Maintaining compliance with Brazilian cybersecurity and data protection regulations is a key responsibility.
• cloud: You will oversee information security controls in cloud environments.
• FinTech: Experience in the FinTech sector is essential for understanding the regulatory landscape.
• ISO 27001: Familiarity with ISO 27001 is necessary for developing and maintaining security policies.

Who this role suits

• A professional with a strong background in information security and compliance.
• Someone who thrives in a collaborative environment and can work independently.
• An individual with experience in the Brazilian financial sector and knowledge of local regulations.
• A detail-oriented person who can analyze technical evidence and communicate findings effectively.

From the employer

What You'll Do

• Serve as the operational lead for cybersecurity governance, risk management, and compliance in Brazil.
• Work directly with local leadership on the entity's information security program and incident-response capabilities.
• Prepare, coordinate, and directly support local leadership in regulatory authorization review, ongoing supervisory engagements, and examinations.
• Provide periodic updates to Ripple Brazil's board and management on the InfoSec program, ICT risk posture, and regulatory developments.
• Maintain compliance with Brazilian regulatory and security frameworks relevant to virtual asset service providers, such as central bank cybersecurity and data protection requirements.
• Map new and evolving guidance issued by the BCB, COAF, and ANPD to Ripple's internal security controls library to identify gaps and enhancement opportunities.
• Scope, plan, and independently conduct periodic technical control testing to validate the effectiveness of information security controls across our cloud, infrastructure, and application environments.
• Directly access systems to pull technical evidence (logs, system settings, access reports) for control testing, audits, and independent assurance reviews.
• Collaborate with global InfoSec teams to develop, maintain, and localize InfoSec Policies, Standards, and Procedures for local regulatory and data protection compliance.
• Lead local oversight of outsourced IT, custody-adjacent, and security service providers, including third-party due diligence and contingency-planning obligations for relevant service providers.
• Support Ripple Brazil's Data Protection Officer on security-of-processing matters.
• Support group-wide Information Security GRC initiatives, ensuring cross-entity alignment as Ripple's regulated footprint in Latin America grows.
• Partner with global Information Security, Engineering, Compliance, Finance, Product, Legal, and Sales teams to provide security guidance with direct impact on Ripple's product security and customer trust in Brazil.
• Support regional customer-facing activities, including drafting Brazil-specific security messaging, responding to security due diligence questionnaires, and reviewing customer security contractual language.
• Develop and maintain information security policies, standards, GRC process documentation, system workflows, and evidence collection procedures.
• Attend and participate in Brazilian and regional digital asset industry events and discussions to stay current on evolving regulation, threats, and best practices.

What You'll Bring

• 5+ years of experience in information security risk management and compliance, ideally including direct exposure to a BCB-regulated (or equivalent) financial institution's authorization or examination process.
• A Bachelor's Degree in a relevant field or equivalent professional experience.
• Based in Brazil, with proven experience in the Brazilian financial or FinTech sector and a strong working understanding of the BCB regulatory landscape.
• Solid understanding of the BCB's PSAV/SPSAV framework and familiarity with the LGPD.
• Proficiency with common information security frameworks, such as ISO 27001, SOC2, NIST, and CSA Cloud Controls Matrix (CCM).
• A proven understanding of information security governance in the context of cloud-native FinTech companies operating in a distributed and fast-moving environment.
• Comfortable working independently in technical environments, quickly learning new systems and processes.
• Hands-on experience pulling and analyzing technical evidence, including system logs, configuration data, audit reports, and database queries.
• Ability to develop clear, audience-tailored documentation, SOPs, and training content.
• Experience collaborating effectively with multi-functional teams of engineers, product managers, and compliance experts.
• Familiarity with tools such as Jira, Confluence, Okta, AWS, Tines, and integrated GRC platforms.
• Desirable certifications include CISSP, CISM, CISA, and AWS Certified Security.
• Fluency in Portuguese; professional proficiency in English.

Who We Are

• The opportunity to build in a fast-paced start-up environment with experienced industry leaders.
• A learning environment where you can dive deep into the latest technologies and make an impact.
• A professional development budget to support other modes of learning.
• Thrive in an environment where no matter what race, ethnicity, gender, origin, or culture they identify with, every employee is a respected, valued, and empowered part of the team.
• In-office collaboration for moments that matter is important to our culture, and we give managers and teams the flexibility to decide which 10+ days a month they come in.
• Bi-weekly all-company meeting - business updates and ask me anything style discussion with our Leadership Team.
• We come together for moments that matter which include team offsites, team bonding activities, happy hours and more!
• Competitive salary, bonuses, and equity.
• Competitive benefits that cover physical and mental healthcare, retirement, family forming, and family support.
• Employee giving match.
• Mobile phone stipend.
• R&R days so you can rest and recharge.
• Generous wellness reimbursement and weekly onsite & virtual programming.
• Generous vacation policy - work with your manager to take time off when you need it.
• Industry-leading parental leave policies. Family planning benefits.
• Catered lunches, fully-stocked kitchens with premium snacks/beverages, and plenty of fun events.

Benefits listed above are for full-time employees.