Information Security Risk Specialist I

Description

*One of the world's largest beauty groups, Grupo Boticário is a Brazilian company present in over 40 countries. It owns the brands O Boticário, Eudora, Quem Disse, Berenice?, Vult, O.U.i, Dr. JONES, Tô.que.tô**, TRUSS, and the marketplace Beleza na Web, in addition to licensing products such as Australian Gold, Bio Oil, Nuxe, and Pampers, and operating a B2B division. This interaction among diverse brands, assets, platforms, franchise networks, representatives, distributors, retailers, sellers, and suppliers forms Grupo Boticário’s beauty ecosystem, which also delivers digital business management solutions for the Brazilian retail sector through its brands Mooz, Casa Magalhães, and GAVB. The Group employs over 19,000 direct employees across more than 4,000 stores in 1\.780 Brazilian cities.* **Join us in creating beauty!** **Responsibilities and duties** * **Strategic Risk Partnership:** Map, identify, and model cyber and corporate risk scenarios originating from digital sources (e.g., data breaches, digital ransom, cyberattacks, and system outages) across the company’s entire ecosystem, transforming technical data into clear business impact insights. * **Audit Orchestration:** Serve as the primary focal point and facilitator for internal and external audits. You will act as the liaison between auditors and technology teams, constructively challenging audit findings, ensuring clarity on control objectives, and validating whether technical responses are robust. * **Maturity Evolution (NIST \& CIS):** Conduct periodic assessments and manage the roadmap for advancing Information Security maturity, using the CIS Controls and NIST CSF frameworks to evaluate and enhance the effectiveness of our technological controls. * **Action Plan Assurance (Remediation):** Support and guide technical teams in developing efficient action plans (A.P.), ensuring proposed corrections address root causes and effectively mitigate opportunities identified during audits. * **PCI DSS Sustenance:** Support the management, design, and effectiveness testing of controls related to PCI DSS certification, ensuring continuous compliance and security of our transactional operations. * **Technological Resilience:** Actively collaborate in mapping discontinuity scenarios for critical environments, supporting decision-making that ensures business resilience and continuity based on technological criticality. * **Metrics and Awareness:** Operationalize GRC tools, review metrics, and create intelligent KRIs (Key Risk Indicators) to monitor risk materialization. Additionally, you will support the dissemination of risk and security culture across the entire company. **Requirements and qualifications** * **Experience in Risk Management and GRC:** Proven experience in Information Security, Technology, or Technological Controls risk management, or IT auditing. * **Market Framework Proficiency:** Practical knowledge and application of global frameworks, mandatorily including NIST CSF and CIS Controls. Familiarity with ISO standards (31000, 27001, 22301\) and COBIT is a plus. * **Audit and Controls Background:** Experience in supporting technology audits, as well as designing, implementing, and testing the effectiveness of mitigating and compensating controls. * **PCI Regulatory Knowledge:** Familiarity with PCI DSS requirements, architecture, and processes for sustaining certification. * **Threat Modeling and Metrics:** Strategic vision to conduct structured risk analyses (qualitative and quantitative) and develop customized modeling per business line. Technical ability to translate risk exposure into actionable GRC indicators (KPIs and KRIs) to support decision-making. * **Artificial Intelligence:** Knowledge of Artificial Intelligence and ability to use AI tools to optimize and improve process efficiency is a differentiator. * **Communication and Diplomacy (Soft Skills):** Excellent corporate communication skills, with the ability to translate complex technical terms into business impacts for diverse audiences. A consultative, resilient profile with strong influencing power to negotiate timelines and solutions with Information Security and Technology teams. * **Business Acumen:** Mindset focused on understanding the company’s value chain, viewing security as an enabler of trust and business growth. * **Builder and Autonomous Profile:** Entrepreneurial mindset (ownership) to independently manage high-complexity projects, drive high-value outcomes, and develop scalable, efficient operations. **Additional information** **OUR BENEFITS** We’ve already mentioned that Grupo Boticário is the **best** and **largest** beauty ecosystem, right? And when it comes to Benefits, we care deeply about our people—so we offer a benefits package**\*** designed to support a more balanced and fulfilling life: * Here, your **Health** is a priority . Medical and dental plan . Medication allowance . Health allowance for family members . Free psychotherapy sessions . Telemedicine and second medical opinions . Free flu vaccination . Health care programs * For your **Nutrition** . Meal voucher or local restaurant allowance (depending on work model) . Food allowance . Christmas food allowance * **Ensuring Well-being and Quality of Life in all aspects of life** . Gym and fitness studio membership plan . Home office allowance (for hybrid and remote work models) . Pet health insurance . Birthday day off . Up to 40% discount on our products . Employee association (with agreements and partnerships, multi-brand store, Total Pass gyms, courses, and much more!) . Travel and accommodation program * For the **Family**, our most precious asset . Childcare allowance . Infant nutrition credit . Babysitter allowance . School supplies allowance . Legal, psychological, and social counseling . Support for atypical parents . Extended parental leave (180 days for mothers and 120 days for fathers) * **Mobility** for your in-person commute . Transportation allowance and parking (for hybrid and in-person models) * **Financial Security** for protection and peace of mind . Life insurance . Bereavement support for parents . Private pension plan . Payroll-deductible loans * *Benefits packages are configured according to eligibility rules.* From a small compounding pharmacy to the planet’s largest cosmetics franchise. We are a Group with 15 brands, present in over 40 countries, operating over 4,000 physical stores, leading Brazil’s beauty e-commerce market, and employing over 19,000 direct employees. We have our own beauty ecosystem—from manufacturing to point-of-sale, logistics to retail, laboratories to consumers’ hearts, and our innovations right at your fingertips. We believe the most beautiful future is the one we build together—thus, by 2030, we have ambitious commitments focused on positive impact across human, environmental, and production process dimensions. We were ranked **"Employer Branding Awards 2025"** by Glassdoor, naming us the best company to work for in Brazil’s retail sector! This recognition is based on voluntary, anonymous reviews from our current and former employees about what it’s like to work here. We reinvent beauty through technology, innovation, diversity, and sustainability—with O Boticário, Eudora, Quem Disse, Berenice?, Vult, O.U.i, Dr. JONES, TRUSS, and the marketplace Beleza na Web, in addition to licensed products such as Australian Gold, Bio Oil, and the Pampers Care line. Join us in creating beauty!