As a Lead Security Engineer you will be a senior technical and risk reference who moves where the risk is, across TPRM, Security Awareness and Cyber Risk, rather than owning a single silo. You will assess security gaps across diverse technologies, third parties and business contexts, quantify what matters, and turn it into prioritized, actionable treatment plans that leadership can decide on.

Assess security gaps across business processes and technologies, enable effective risk treatment, and define remediation plans with clear owners and deadlines.

Work closely with ITSec, Risk, Procurement stakeholders to align on mitigation of identified risks and on risk acceptance decisions.

Lead the evolution of the TPRM program toward a risk-based, lifecycle model: onboarding, continuous monitoring, offboarding, and fourth-party visibility.

Define/review security requirements for third parties, including contractual security clauses and annexes, and guide business owners on their application.

Build and scale automation and AI-assisted assessment capabilities that reduce manual questionnaire effort and increase coverage.

Report third-party risk posture and trends to leadership and relevant committees.

Drive human risk programs through phishing simulations, training and communication and evaluate and evolve the tooling behind them (build versus buy).

Define and track behavior-change metrics that go beyond completion rates, and report them through dashboards for management.

Act as technical lead across the squad, raising the technical and analytical bar and fostering continuous improvement.

We are looking for a person who has

Proven experience designing and implementing security controls and leading risk management initiatives, with strong knowledge of domains and concepts of cyber risks.

Lead Security Engineer - GRC

Responsibilities

Qualification

Required

Preferred

Benefits

Company

Nubank

More roles at Nubank