Senior Information Security Analyst/Cyber Security Senior

Description

Senior professional to serve as a technical and strategic reference in security architecture. Responsible for guiding multidisciplinary teams, designing secure solutions aligned with service criticality and information classification. Requires a 360° perspective—from secure development pipelines incorporating DevSecOps practices at the code level, to governance and the creation of policies and standards based on leading information security frameworks (ISO/NIST/IA). ### **Key Responsibilities** * **Strategic Consulting**: Serve as the focal point for providing technical direction to multidisciplinary teams on security topics. Support the definition of complementary and parallel security activities such as backup & restore, information classification, asset criticality, and other areas where information security is relevant. * **Vulnerability Management**: Lead the vulnerability lifecycle, defining scan scopes, interpreting penetration test results, and prioritizing remediations (patches) based on risk. * **Identity Architecture (IAM)**: Design and oversee the identity lifecycle, implementing concepts including Least Privilege, Multi-Factor Authentication (MFA), Single Sign-On (SSO), and other priority controls. * **Secure Development**: Integrate security controls such as SAST/DAST into development pipelines, promoting secure coding practices and DevSecOps. * **Data Protection (DLP & Cryptography)**: Lead initiatives for data loss prevention (DLP), secret management (Secrets), and cryptographic key management. * **Governance and Processes**: Establish technical policies and procedures aligned with ISO 27001, NIST RMF, and organizational policies/standards. * **Attack Surface Management**: Define operational scopes and structure ASOC (Attack Surface Optimization Center), environment segregation, and consider configuration item and asset control (CMDB). * **Incident Response and Change Management**: Guide security actions for inclusion in Change Management processes and support Incident Management by validating compliance with defined security requirements. * **AI Security**: Solid knowledge of applying the NIST AI RMF framework and OWASP Top 10 for LLMs guidelines. Ability to leverage generative AI–based security tools for ASOC (automation) optimization, plus experience mitigating risks such as Prompt Injection, Data Poisoning, and malicious use of Deepfakes." ### **Technical Requirements** * **Frameworks**: Practical expertise in ISO/IEC 27001, NIST CSF, and privacy standards (LGPD/GDPR). * **Infrastructure and Cloud**: Strong experience in cloud computing security (AWS, Azure, or GCP) and secure network architecture. * **Application Security**: In-depth knowledge of OWASP methodologies, Microsoft SDL, scanning tools, and CI/CD pipelines. * **Cryptography**: Proficiency in secure communication protocols, certificate management (PKI), and encryption at rest/in transit. * **Tooling**: Experience with SIEM tools, EDR/XDR (endpoint detection and response), WAF, vulnerability scanners (Tenable, Nessus, Qualys or similar), NDR (network detection and response), Threat Intelligence, and secret management (Vault). * **Identity**: Experience configuring IdPs (Okta [idaaS, Zero Trust], Azure AD, Ping) and protocols (SAML [SSO], OIDC [what, who, JWT usage]). ### **Behavioral Skills** * **Advanced Logical Reasoning**: Ability to decompose complex problems into technically viable solutions. * **Business Acumen**: Skill in aligning security with service criticality (focus on what is vital to the business). * **Consultative Communication**: Ability to translate technical terminology for executives and influence developers. * **Autonomy and Technical Leadership**: Capability to make architectural decisions under pressure. ### **Differentiators (Certifications) — at least one actively held** * **CISSP** (Certified Information Systems Security Professional) * **CCSP** (Certified Cloud Security Professional) * **Cloud Architecture Certifications** (AWS Security, Azure Security Engineer) * **CSSLP** (Certified Secure Software Lifecycle Professional) * **CISM** (Certified Information Security Manager) **MJV Benefits:** TotalPass\\Wellhub; ‍‍‍‍ Group life insurance; Meal/Voucher allowance; Health and dental plan — Bradesco; Training initiatives: lectures, forums, knowledge-sharing sessions, and discussions related to our business. We maintain constant connection to learn more—together; \+MJVer Program: internal referral program where you refer a colleague to join us, and if the match is successful, you receive a reward. Partnerships: want discounts? We have a Workplace group where we announce partnerships with educational institutions, language schools, gyms, restaurants, products, and other services;