Senior Cybersecurity Analyst

Description

Senior professional to act as a technical and strategic reference in the security structure. Responsible for guiding multidisciplinary teams, designing secure solutions aligned with the criticality of services and information classification. A 360° vision is required, from code with a DevSecOps approach in a secure development pipeline to the governance and production of policies and standards based on the main information security frameworks (ISO/NIST/IA). #### **Main Responsibilities** **Strategic Consulting**: Act as a focal point for the technical direction of multidisciplinary teams on security topics. Support the definition of parallel and complementary topics to security routines, such as backup \& restore, information classification, asset criticality, and other topics where information security is present. **Vulnerability Management**: Lead the vulnerability lifecycle, defining scan scopes, interpreting Pentest results, and prioritizing corrections (Patches) according to risk. **Identity Architecture (IAM)**: Design and supervise the identity lifecycle, implementing concepts such as Least Privilege, MFA, SSO, and other priority items. **Secure Development**: Integrate controls such as SAST/DAST into the development pipeline, promoting security practices and DevSecOps. **Data Protection (DLP \& Encryption)**: Lead initiatives for Data Loss Prevention (DLP), secrets management, and cryptographic keys. **Governance and Processes**: Structure technical policies and procedures based on ISO 27001, NIST RMF, and organizational policies/standards. **Attack Surface Management**: Determine scopes of action and ASOC structuring, environment segregation, and consider the control of configuration items and assets (CMDB). **Incident Response and Change**: Direct security actions for registration in Change Management processes and support Incident Management by validating compliance with established security requirements. **AI Security**: Solid knowledge of the application of the NIST AI RMF framework and OWASP Top 10 guidelines for LLMs. Ability to use generative AI-based security tools for ASOC optimization (automation), in addition to experience in mitigating risks of Prompt Injection, Data Poisoning, and the malicious use of Deepfakes." #### **Technical Requirements** * **Frameworks**: Practical mastery of ISO/IEC 27001, NIST CSF, and privacy standards (LGPD/GDPR). * **Infrastructure and Cloud**: Solid experience in Cloud Computing security (AWS, Azure, or GCP) and secure network architecture. * **Application Security**: In-depth knowledge of OWASP methodologies, Microsoft SDL, scanning tools, and CI/CD pipelines. * **Encryption**: Mastery of secure communication protocols, certificate management (PKI), and encryption at rest/in transit. * **Tooling**: Experience with SIEM, EDR/XDR (endpoint detection), WAF, Vulnerability Scanners (Tenable, Nessus, Qualys, or similar), NDR (network detection and response), Threat Intelligence, and Secrets management (Vault). * **Identity**: Experience in configuring IdPs (Okta (IdaaS, Zero Trust), Azure AD, Ping) and protocols (SAML (SSO), OIDC (what, who, use JWT)). #### **Behavioral Skills** * **Refined Logical Reasoning**: Ability to decompose complex problems into viable technical solutions. * **Business Vision**: Ability to associate security with the criticality of services (focus on what is vital for the company). * **Consultative Communication**: Ability to translate technical terms for executives and influence developers. * **Autonomy and Technical Leadership**: Ability to make architectural decisions under pressure. #### **Differentiators (certifications) \-** ***at least 1 of them effectively*** * CISSP (Certified Information Systems Security Professional) * CCSP (Certified Cloud Security Professional) * Cloud Architecture Certifications (AWS Security, Azure Security Engineer) * CSSLP (Certified Secure Software Lifecycle Professional) * CISM (Certified Information Security Manager)