Hybrid Senior Information Security Analyst – GRC and Data Privacy

at Vero

• Job title: Senior Information Security Analyst – GRC and Data Privacy
• Job type: Full Time
• Experience level: Senior
• Salary: Not specified
• Degree requirement: Bachelor's Degree
• Location requirements: Hybrid, Sao Paulo, Brazil

About the role

• Senior Information Security Analyst ensuring compliance and data privacy at VERO. Involved in governance, risk management, and promoting security culture.

Responsibilities

• Drive the structuring, operationalization and evolution of Information Security, Risk and Privacy practices, ensuring the protection of information assets, regulatory compliance and support for strategic decision-making through the implementation and strengthening of the Information Security Management System (ISMS) and integration of controls into business processes, with corporate-wide scope across the organization.
• Ensure compliance with standards, internal policies and regulatory requirements through the structuring and execution of internal audits, maturity assessments of critical vendors and monitoring of corrective action plans.
• Provide executive visibility on risks and information security through the definition and management of metrics, creation of dashboards and preparation of management reports to support decision-making.
• Ensure governance of Information Security and Risk topics by organizing and conducting committees, preparing executive materials, recording decisions and following up on action plans.
• Ensure integration of security and privacy requirements into corporate processes and projects by collaborating with business areas and applying security and privacy by design principles.
• Ensure compliance with personal data protection legislation by providing operational support to the DPO, structuring and managing processes such as data subject requests, data inventory (RoPA) and conducting impact assessments (DPIA and BIA).
• Promote an Information Security and Privacy culture across the organization through training, awareness and dissemination of best practices with business areas.

Requirements

• Proven experience in Information Security with work in GRC, including implementation and maintenance of an ISMS, risk management, audits, regulatory compliance (especially LGPD), data privacy, interaction with business areas and leading governance and metrics initiatives.
• Bachelor's degree in Information Systems, Computer Engineering, Computer Science, Networks or related fields.
• Postgraduate degree or specialization in Information Security, Risk Management, Compliance, IT Governance or Data Privacy is desirable.
• Advanced knowledge of Information Security Management (ISMS).
• Advanced knowledge of Enterprise and IT Risk Management.
• Advanced knowledge of LGPD and Data Privacy.
• Advanced knowledge of Governance and Compliance (e.g., ISO 27001, NIST).
• Intermediate knowledge of Power BI.
• Executive communication and committee facilitation.
• Stakeholder management and organizational influence.
• Organization, prioritization and autonomy.

Benefits

• Flexible Benefits Plan
• Transportation allowance
• Health insurance
• Dental insurance
• Life insurance
• PPR (Performance-Based Bonus Program)
• Growth opportunities
• Childcare assistance
• Allowance for employees with children with disabilities
• Day Off (one day off during your birthday month)
• TotalPass (discounts on gyms/sports)
• Corporate University
• PAS (Vero Social Assistance Program)