IT Risk Management Specialist at Nubank · LumiJobs
H1B: yes
Nubank IT Risk Management Specialist at Nubank responsible for second-line oversight of technology and information security risks globally. Conducts risk assessments and partners with multiple teams to govern technology risks and ensure safe growth.
Responsibilities
This position sits within Nubank’s global risk management team and provides second-line oversight of technology and information security risks across Nubank’s global systems, platforms, and processes. You will work closely with Engineering, Information Security, Data, Product, Business, and local Risk Management teams to identify, assess, and govern technology risks while enabling the company to grow safely and at speed.
You’ll be Responsible for
Conduct IT and cybersecurity risk assessments across technology domains, platforms, products, features, and critical processes, identifying threats, vulnerabilities, potential impacts, and appropriate risk responses.
Assess and challenge technology risks associated with new products, features, systems, infrastructure, and material changes, helping teams identify and address risks early in the lifecycle.
Partner with Engineering, Information Security, Data, Product, Business, and local Risk Management teams to develop mitigation plans aligned with risk appetite, global standards, and applicable regulatory requirements.
Support the implementation and consistent application of global IT Risk frameworks, methodologies, policies, procedures, metrics, and governance practices across Nubank’s operations.
Implement, mMonitor and analyse Key Risk Indicators, metrics, and dashboards for technology and cybersecurity risks, identifying changes in risk exposure and escalating matters that require attention.
Prepare clear risk assessments, reports, and recommendations for technical stakeholders, senior management, governance forums, and risk committees.
Support independent control testing and the assessment of control effectiveness, documenting gaps and recommending practical risk mitigants and action plans.
Monitor technology, cybersecurity, and data-platform incidents; contribute to root-cause analysis, assess systemic implications, and connect remediation plans to the risk governance framework.
Provide IT and cybersecurity risk expertise for third-party services, cloud environments, APIs, telecommunications infrastructure, and other technology dependencies.
Monitor regulatory developments, emerging threats, technology changes, and industry practices, assessing their implications for Nubank’s IT Risk posture.
Qualification
Strong experience in technology areasStrong grounding in risk assessmentConstructive-challenge mindsetStrong ownershipBachelor’s degree in Computer Science
Required
Strong experience in technology areas, information security, IT risk management, internal controls or another risk-heavy technical role.
Solid understanding of modern technology environments, including information security fundamentals, cloud-native environments such as AWS and GCP, microservices, APIs, CI/CD pipelines, containers, serverless technologies, and distributed systems.
Strong grounding in risk assessment, risk analysis, mitigation planning, control effectiveness, incident management, risk monitoring, and governance reporting.
Familiarity with risk and security frameworks and regulatory expectations, such as NIST, ISO/IEC 27001, LGPD, and applicable financial-services requirements.
Ability to translate complex technical topics into clear business and risk-oriented insights for audiences with different levels of technical knowledge and seniority.
Constructive-challenge mindset, with the ability to remain independent while building effective partnerships with first-line teams.
Strong analytical and problem-solving skills, including the ability to structure ambiguous situations, prioritise risks, and make sound risk-based recommendations.
Excellent communication and stakeholder management skills.
Ability to work effectively across global and local teams, geographies, functions, and lines of defence.
Pragmatic and collaborative approach to risk management, balancing robust controls with simplicity, speed, and customer focus.
Strong ownership, organisation, attention to detail, and ability to manage multiple priorities in a fast-moving environment.
Bachelor’s degree in Computer Science, Engineering, Information Technology, Business, or a related field.
