Descrição da Vaga

SENIOR CYBER RISK SPECIALIST (HYBRID OR REMOTE BRAZIL)

Company hires for hybrid or remote position

📍 Location: Brazil — candidates from any region are welcome

⚠️ Only candidates already based in Brazil will be considered

💼 Work Model: Hybrid for candidates living in state capitals and Remote for candidates living in countryside/cities outside the state capitals

🗣️ Language Requirements: Advanced or Fluent English

🕓 Seniority: Senior (6+ years)

💲Rate: Candidates should provide their salary expectations

⚠️ Instructions: Please send your CV in English and make sure to include all skills and experience that match the requirements of the opportunity. This will significantly increase your chances of success.

About the Opportunity

We are looking for an experienced Senior Cyber Risk Specialist to support the development and continuous improvement of Cyber Risk Management frameworks and methodologies in a complex enterprise environment.

The professional will be responsible for identifying, assessing, and monitoring cybersecurity risks, evaluating security controls, and translating technical vulnerabilities into business impacts and actionable recommendations.

Responsibilities

• Support the development and improvement of Cyber Risk Management frameworks and methodologies.
• Identify, analyze, and assess cybersecurity risk scenarios, including inherent and residual risks.
• Evaluate the design, effectiveness, and maturity of security controls.
• Support Risk Acceptance, Exception Management, and Risk Treatment processes.
• Develop and monitor Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), Risk Registers, and dashboards.
• Conduct cyber risk assessments involving vendors and third-party providers.
• Collaborate with Technology, Privacy, Resilience, and Operational Risk teams.
• Facilitate stakeholder interviews and workshops, preparing risk reports and executive presentations.

Requirements

• Strong professional experience in Cyber Risk, Information Security Risk, Technology Risk, or related areas.
• Solid knowledge of Risk Management methodologies and cybersecurity risk assessment practices.
• Experience identifying and evaluating cybersecurity risk scenarios.
• Hands-on experience conducting inherent and residual risk assessments.
• Knowledge of security control design, effectiveness, and maturity assessments.
• Ability to translate technical vulnerabilities and security risks into business impacts and recommendations.
• Strong analytical, communication, and stakeholder management skills.
• Advanced or fluent English for communication in international environments.

Nice to Have

• Experience with Third-Party Risk Management or Vendor Cyber Risk assessments.
• Knowledge of Risk Acceptance, Exception Management, and Risk Treatment Plans.
• Experience with KRIs, KPIs, Risk Registers, and risk dashboards.
• Understanding of Technology Risk, Privacy Risk, Resilience, and Operational Risk.
• Certifications such as CRISC, CISSP, CISM, CISA, or ISO 27001-related certifications.

Ideal Candidate Profile

A Senior Cyber Risk Specialist with strong expertise in cybersecurity risk assessment, security control evaluation, and enterprise risk management. The ideal candidate demonstrates analytical thinking, business-oriented risk communication, and the ability to collaborate with technical teams, business stakeholders, and executive leadership in an international environment.

5 Questions for Candidates

1. How many years of professional experience do you have in Cyber Risk, Information Security Risk, or Technology Risk?
2. What is your experience conducting inherent and residual risk assessments and evaluating security controls?
3. Have you worked with Cyber Risk Management frameworks, Risk Acceptance, Exception Management, or Risk Treatment Plans?
4. What is your experience with Third-Party Cyber Risk, KRIs, KPIs, Risk Registers, and executive risk reporting?
5. What are your current salary, salary expectations, and availability to work in a hybrid or remote model in Brazil?

Keywords

Cyber Risk, Cyber Risk Management, Information Security Risk, Technology Risk, Cybersecurity, Risk Assessment, Inherent Risk, Residual Risk, Security Controls, Risk Management Framework, Third-Party Risk, Vendor Risk Management, Risk Acceptance, Exception Management, Risk Treatment, KRIs, KPIs, Risk Registers, Risk Dashboards, Operational Risk, Privacy Risk, Resilience, CRISC, CISSP, CISM, CISA, ISO 27001

#EY BR