SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
RecargaPay is a Brazilian fintech building a digital payments and credit ecosystem for consumers and small businesses. As Senior Security Governance Analyst, you will own the information security governance function, maintaining ISO 27001, ISO 22301, and PCI DSS certifications, ensuring compliance with Brazilian financial regulations (CMN Resolution 4.893 and BCB Resolution 85), and operationalizing security policies, third-party risk management, and business continuity across the organization.
Key responsibilities include:
- Maintain ISO 27001, ISO 22301, and PCI DSS certifications through annual scope definition, control assessment, evidence collection, certification audits, and non-conformity remediation.
- Ensure compliance with CMN 4.893 and BCB 85 by mapping regulatory requirements to controls, monitoring regulatory changes, and reporting gaps and action plans to leadership.
- Manage the Information Security Management System (SGSI): risk assessment, KPI tracking, management reviews, internal audits, and continuous improvement.
- Develop, implement, and maintain security policies, standards, and procedures with defined review cycles and effective adoption across business units.
- Execute third-party risk management (TPRM): security due diligence, criticality classification, questionnaire and evidence analysis, and ongoing third-party risk monitoring.
- Lead business continuity management: impact analysis (BIA), continuity and recovery planning, periodic testing and exercises with responsible teams.
- Plan and execute security awareness and training programs with effectiveness metrics.
- Support internal and external audits by coordinating requests, evidence, responses, and tracking remediation to closure.
You will work autonomously across technology, product, legal, and audit functions, conducting end-to-end audit evidence management for internal and external audit cycles.
REQUIREMENTS:
- Proven senior-level experience in Information Security Governance, Risk & Compliance (GRC), preferably in fintech, payments institutions, or regulated financial sector.
- Hands-on experience maintaining an ISO 27001-compliant SGSI and sustaining certification through audit cycles.
- Solid knowledge of PCI DSS requirements and practical experience with evidence and assessments.
- Knowledge of Brazilian financial sector cybersecurity and continuity regulations (CMN 4.893 and BCB 85).
- Experience in third-party risk management (TPRM): supplier and partner evaluation based on criticality.
- Experience supporting internal and external audits, working directly with auditors and regulators.
- Fluent Portuguese; technical English for documentation reading and writing.
Differentiators:
- ISO 22301 experience and business continuity management (BIA, planning, testing).
- SOX and IT General Controls (ITGC) knowledge.
- Certifications: ISO 27001 Lead Implementer/Auditor, ISO 22301 Lead Implementer/Auditor, CISA, CISM, CRISC, or PCI ISA.
- GRC tool experience and security awareness program management.
