Information Security Analyst in Botafogo, Rio de Janeiro at ONErpm

About ONErpm

Founded in 2010, ONErpm is a global music solutions company with 45 offices and studios in 35+ countries with over 615 staff members across the world, with significant presence in Brazil, the U.S., Europe, and other markets. ONErpm encompasses distribution, label solutions, content production, publishing, and an innovative marketing group that includes in-house advertising and influencer agencies, ONErpm has a proven track record of providing local and global support to artists and creators at any stage of their careers.

What you'll do

• Security in Design: Integrate security requirements and perform threat modeling/project risk analyses in the early stages of system design and feature development (Security by Design)
• Pipeline & Code Security (AppSec): Implement, operate, and maintain automated security tooling (SAST, DAST, SCA) in CI/CD pipelines; assist software engineers in remediating vulnerabilities using OWASP Top 10 guidelines and secure coding frameworks.
• Cloud Security Posture: Evaluate, monitor, and improve the security posture of cloud infrastructure and technology environments based on recognized benchmarks such as CIS Controls and cloud security best practices.
• Privacy & LGPD Compliance: Establish and manage operational workflows for data subject access requests (DSARs), maintain the continuous data mapping lifecycle, and evaluate privacy risks in new product features.
• Penetration Testing Coordination: Coordinate regular external/internal pentesting procedures, including environment provisioning, scoping requirements between vendors and internal development teams, and managing remediation tracking.
• Vendor & Third-Party Risk Management: Implement and oversee IT vendor security assessments to evaluate and mitigate the aggregate risks introduced by third-party tools, services, and partners.
• Security Awareness & Culture: Plan and execute continuous security awareness programs, phishing simulations, and training sessions to build a proactive security mindset across the organization.
• Incident Management & Root Cause Analysis: Monitor, respond to, and investigate information security and privacy incidents, analyzing root causes and implementing preventative controls.
• Due Diligence & Audit Response: Conduct and respond to security and privacy due diligence assessments from customers, vendors, and regulatory auditors
• Metrics & Indicators: Develop, track, and report Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for Information Security and Privacy maturit
• Compliance & Regulations: Ensure adherence to internal company policies, compliance regulations, industry standards, and workplace health and safety rules pertinent to the position
  
  

Qualifications

• Higher Degree (Bachelor’s) in Information Security, Computer Science, Software Engineering, Systems Analysis, or related technology fields.
• Desirable Certifications: CompTIA Security+, AWS/Azure Security Specialty, Certified AppSec Practitioner (CAP), EXIN Privacy & Data Protection (LGPD/GDPR), or ISO 27001 Lead Implementer/Auditor.
• Proficiency in SAST, DAST, and SCA tools and their integration into CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Azure DevOps).
• Solid understanding of the OWASP Top 10, CIS Controls, and cloud security architecture (AWS, GCP, or Azure).
• In-depth knowledge of the General Data Protection Law (LGPD), data mapping, and DSAR management workflows.
• Familiarity with third-party risk management (TPRM) frameworks and pentest scoping/vendor management.
• Solid fundamentals in networking, protocols, identity and access management (IAM), and technology infrastructure.

• Health and Dental Insurance
• Meal Allowance (Groceries)
• Meal Allowance (Restaurants)
• Life Insurance
• TotalPass
• Birthday Day Off