Staff Cybersecurity Engineer

Description

**We encourage and prioritize applications from women, Black people,** **people with disabilities and LGBTQIA\+** **About the position** ------------------- ImpulsoGov is a non-profit organization that uses technology and data to strengthen primary care in the SUS, supporting municipalities throughout Brazil. We process sensitive health data from millions of people, and protecting this data is a central part of our institutional responsibility. This will be the first position dedicated exclusively to information security at ImpulsoGov. We are looking for a senior, hands\-on individual with high autonomy to structure, execute, and evolve the organization's cybersecurity foundations. This is an individual technical leadership role, working transversally with the leadership of Technology, Engineering, Data, Product, and Internal Management. The hired person will have the mandate to prioritize risks, propose controls, operate tools, and support the building of a pragmatic security culture, proportional to our context and oriented toward impact. **Responsibilities** --------------------- The person will be responsible for structuring and executing ImpulsoGov's security agenda, focusing on the following pillars: ### **1\. Cloud, infrastructure, and access** * Review and evolve the security posture of the infrastructure on Google Cloud. * Support secure architecture decisions from conception, including IAM, networks, isolation, secrets, keys, logs, and hardening. * Review privileges, critical accounts, administrative access, and exposure of sensitive environments. * Implement least privilege practices, MFA, segregation of duties, and periodic access reviews. ### **2\. Devices, identity, and internal tools** * Deploy and operate the team's device management, including MDM, configuration policies, and inventory. * Evaluate, configure, and operate tools such as EDR, VPN, AppSec solutions, secrets management, and security monitoring. * Structure simple and sustainable processes for onboarding, offboarding, and access control. ### **3\. DevSecOps and application security** * Evolve the development cycle with shift\-left security practices. * Implement or improve SAST, DAST, SCA, dependency analysis, secrets management, and CI/CD security. * Support the strategy for opening repositories on GitHub, ensuring that code, history, secrets, and dependencies are secure before publication. * Work with Engineering and Product to make security a natural part of development (DevSecOps), without creating unnecessary bureaucracy. ### **4\. Governance, risk, and incident response** * Conduct diagnostics and self-assessments based on recognized frameworks, such as CIS Controls, NIST CSF, OWASP SAMM, and ISO 27001\. * Prioritize security risks considering impact, probability, effort, and organizational context. * Structure practical controls to support compliance with LGPD and the protection of sensitive personal data. * Create basic incident response playbooks, communication flows, severity criteria, and learning routines. * Coordinate pentests, external assessments, and relationships with security vendors. **Prerequisites** ------------------- * Practical and senior experience in information security, cloud security, AppSec, DevSecOps, identity/access, or infrastructure. * Ability to work autonomously in a lean structure, prioritizing by risk and impact. * Solid knowledge of cloud security, ideally in Google Cloud. * Experience with IAM, MFA, least privilege, privileged accounts, and access management. * Experience with DevSecOps practices, such as SAST, DAST, SCA, secrets management, pipeline hardening, or dependency security. * Willingness to perform operational work, configure tools, document processes, and follow implementation through to completion. * Good communication skills to translate technical risks into clear decisions for technical and non-technical audiences. **Differentiators** ---------------- * Having been the first security person in an organization or having structured a security function from scratch. * Experience with sensitive personal data, health data, LGPD, or regulated environments. * Experience with CIS Controls, NIST CSF, ISO 27001, OWASP SAMM, or OWASP ASVS. * Experience with MDM, EDR, SIEM, CSPM, CNAPP, or AppSec tools. * Experience conducting or contracting pentests. * Certifications such as CISSP, CCSP, OSCP, Google Professional Cloud Security Engineer, Security\+, or equivalents. * Previous experience in the third sector, public health, government, or social impact projects. * Intermediate or advanced English. **Selection process stages** ------------------------------- * Resume analysis; * Technical challenge; * Interview with the People and Culture team; * Technical interview; * Final interview. **About the job** ---------------- * **Compensation:** Market competitive * **Benefits:** + Delivery-Free Period \- 20 business days for you to take without deliveries during the year (proportional to the contract period); + WellHub (formerly Gympass); + Zenklub \- with two monthly sessions paid by ImpulsoGov directly on the platform; + Alice Health Plan or health voucher to contract your preferred health plan; + English classes via the Cambly platform + Credit of 880 reais on the Caju card; + Parental leave period \- 88 business days of absence from work for new mothers and fathers; + HomeOffice Equipment Allowance; + Notebook rented by ImpulsoGov. + Birthday Day Off. + All holidays extended, following the São Paulo calendar. + Availability of Claude (AI tool) for optimizing your work processes. * **Employment regime:** PJ * **Dedication:** 40 hours per week with a flexible schedule. * **Format:** Remote. + Availability is required 2x a year for in-person immersion in São Paulo and occasional offsites. + Availability is required for on\-call or emergency situations. **Any questions, write to leticia@impulsogov.org**