Join Nu: Lead Security Engineer (Cyber Risk, TPRM & Security Awareness)
Nu is not just a company; it's a movement. With over 140 million customers, our mission is to simplify finance, eliminate complexity, and empower individuals globally. We're disrupting an entire industry with cutting-edge technology, innovative products, and human-centered services that foster financial access, advancement, and transparency.
At Nu, proprietary technology and data at scale form the backbone of our digital platform. Our business model thrives on customer loyalty and operational efficiency, driving a powerful flywheel of growth and profitability. Be part of a company that truly makes a difference in people's lives.
Visit our Institutional Page to learn more.
About the Role: Your Impact as a Lead Security Enginee
Are you a seasoned security professional eager to make a broad, strategic impact? As a Lead Security Engineer at Nu, you won't be confined to a single security silo. Instead, you'll be a senior technical and risk authority, dynamically moving across critical domains including Third-Party Risk Management (TPRM), Security Awareness, and broader Cyber Risk.
This is an exceptional opportunity to assess security gaps across a vast landscape of diverse technologies, intricate third-party relationships, and evolving business contexts. You will quantify what truly matters, translating complex risks into prioritized, actionable treatment plans that directly inform leadership decisions. You'll architect, build, and evolve the policies, methodologies, platforms, and automation behind these crucial programs, scaling our defenses across Brazil, Mexico, Colombia, and other global markets without linearly scaling headcount.
You’ll be a vital partner to our Engineering, Product, Legal, Procurement, Operations, Internal Communication, and Risk teams, as well as business stakeholders, transforming high-level requirements into clear, pragmatic technical specifications. This is a truly multidisciplinary and global role, collaborating with teams primarily based in Brazil, Mexico, Colombia, and the United States.
What You'll Do: Drive Our Security Forward
Strategic Risk Management & Remediation
Proactively assess security gaps across business processes and technologies, facilitating effective risk treatment and defining clear remediation plans with assigned owners and deadlines.
Collaborate closely with ITSec, Risk, and Procurement stakeholders to align on identified risk mitigation strategies and crucial risk acceptance decisions.
Third-Party Risk Management (TPRM) Leadership
Lead the strategic evolution of our TPRM program towards a robust, risk-based lifecycle model encompassing onboarding, continuous monitoring, offboarding, and critical fourth-party visibility.
Define and meticulously review security requirements for third parties, including comprehensive contractual security clauses and annexes, while guiding business owners on their pragmatic application.
Architect and scale automation and AI-assisted assessment capabilities to significantly reduce manual questionnaire effort and dramatically increase coverage and efficiency.
Regularly report comprehensive third-party risk posture and emerging trends to senior leadership and relevant governance committees.
Human-Centric Security Programs
Drive impactful human risk programs through strategic phishing simulations, engaging training modules, and effective communication campaigns. You'll also evaluate and evolve the underlying tooling (build versus buy) to maximize effectiveness.
Define and rigorously track behavior-change metrics that go beyond mere completion rates, reporting these insights through dynamic dashboards for management.
Technical & Team Leadership
Act as a pivotal technical lead across the squad, consistently raising the technical and analytical bar and fostering an environment of continuous improvement and innovation.
What You Bring: Skills & Experience
Proven expertise in designing and implementing robust security controls and leading impactful risk management initiatives, coupled with a deep understanding of cyber risk domains and concepts.
Hands-on experience with advanced risk analysis techniques, including meticulous risk identification, comprehensive assessment, and pragmatic prioritization, utilizing both qualitative and quantitative methods.
Extensive experience with Third-Party Risk Management (TPRM) programs.
Demonstrated experience in building or running sophisticated security awareness and human-risk programs, or a strong aptitude to rapidly acquire expertise in these areas.
Practical experience with large-scale distributed environments and cloud platforms (e.g., AWS, GCP, Azure).
Familiarity with industry-leading frameworks such as NIST CSF, NIST SP 800-30, ISO 27001/27002/27005, ISO 31000, PCI-DSS, ITIL, COBIT, and similar standards.
Exceptional executive communication skills, with the ability to translate highly complex technical topics into clear, concise, and actionable insights for senior leadership and committees.
A strong technical background and comfort with automation, scripting, and leveraging AI or LLM-based tooling to scale and optimize security processes.
Experience operating in highly regulated and global environments, including effective interaction with auditors and regulatory bodies.
Proven ability to lead projects, drive process improvement initiatives, and effectively mentor other engineers and analysts.
Advanced English proficiency, both written and spoken. Spanish is a significant plus.
Bonus Points: What Sets You Apart
Bachelor’s degree in Engineering, Technology, Information Security, Risk Management, or related fields.
Industry certifications such as PCI ISA or PCIP, CISA, CISM, or CISSP.
Experience in a regulated fintech, financial services environment, or consulting roles.
Direct experience with AI risk: assessing risks associated with generative AI and LLM use cases (e.g., data leakage, prompt injection, model risk, and vendor risk).
Location for this Opportunity
São Paulo, Brazil
Campinas, Brazil
Rio de Janeiro, Brazil
Belo Horizonte, Brazil
Benefits at Nu
Opportunity to earn equity at Nubank
Food/Meal Card (Vale-Refeição and/or Vale Alimentação)
Public Transportation Commuting Benefit (Vale-Transporte)
NuCare – Comprehensive Psychological, Financial, and Legal Assistance Program
Life Insurance
Medical Plan
Dental Plan
NuLanguage – Language Course Program
Nucleo - Our extensive learning platform with various courses
Extended Parental Leave
Daycare Allowance
Parental Consultancy
Work-from-home Allowance
Gym Partnerships
30 days of paid vacation
Relocation Assistance Package, if applicable
Work Model for this Role
Hybrid: 2-3 times/week. Our hybrid work model brings us to the office at least twice a week on strategic days designed to maximize team connection and collaboration. For more details, visit https://building.nubank.com/nu-hybrid-work-model/
Our recruitment process may involve the use of artificial intelligence–enabled tools, such as automated interview transcription and analysis, to support the evaluation process. Artificial intelligence is not used to make final hiring decisions; all decisions are made by human reviewers.
To maintain a consistent and fair process for every candidate, Nu does not provide individualized technical feedback. See how our policy works here.