Description: Mandatory: * Experience with security policies, access management, and incident response. * Knowledge of cloud security (AWS and GCP), system hardening, and DLP. * Familiarity with security frameworks (ISO 27001, NIST, LGPD). * Experience with penetration testing tools, SIEM, EDR, and vulnerability scanners. Desirable: * Certifications such as: Security+, ISO 27001 Lead Implementer, CEH, OSCP, CompTIA CySA+. * Experience with DevSecOps and CI/CD. * Advanced Red Team techniques. Governance and Security Policies * Lead the creation, updating, and dissemination of information security policies (ISP), standards, guidelines, and procedures. * Evaluate and propose continuous improvements to security guidelines in accordance with best practices (ISO 27001, CIS Controls, NIST, etc.). * Conduct compliance validation against LGPD and security policies for vendors, partners, and utilized tools. Access and Identity Management * Define and execute Access and Privilege Management (IAM, PAM) processes based on the principle of least privilege and role segregation. * Perform periodic access reviews and permission audits across cloud and on-premise environments. Infrastructure and Application Security * Support technical teams in defining and implementing hardening for servers, endpoints, and containers. * Assess and guide remediation of vulnerabilities in applications, networks, on-premise infrastructure, and cloud environments (AWS, GCP, etc.). * Participate in security assessments throughout secure development lifecycles (DevSecOps). DLP, Monitoring, and Auditing * Manage and operate DLP (Data Loss Prevention), SIEM, and EDR/XDR solutions. * Monitor alerts and generate compliance reports, anomaly behavior reports, and reports on exposure of sensitive data. * Actively participate in internal and external audits. Incident Response and Business Continuity * Respond to security incidents by identifying, containing, eradicating, and recovering from them. * Participate in developing and testing the Incident Response Plan and Business Continuity Plan (BCP/DRP). Red Team (Offensive Activities / Security Testing) * Conduct and/or oversee vendor-led activities including: * Penetration tests (pentests) and attack simulations (e.g., phishing). * Attack surface assessment (Attack Surface Management). * Simulations of data exfiltration and lateral movement. * Produce executive and technical vulnerability reports and coordinate corrective actions with responsible teams. Blue Team (Defensive Activities / Monitoring) * Perform continuous security monitoring via SIEM, DLP, and detection solutions. * Implement and maintain security controls on endpoints, servers, and cloud environments. * Develop security metrics, support investigations, and prepare forensic evidence when required. * Participate in organization-wide attack simulation exercises. 2512170202551871061