Information Security Analyst

We are looking for an Information Security Governance Analyst to support the definition, implementation, and maintenance of security policies, standards, and controls, working in governance, risk, and compliance (GRC). The professional will support risk assessments, audits, monitoring of action plans, and ensure adherence to market best practices and frameworks, working closely with internal areas and technical leadership.

Responsibilities and duties Act in response to information security incidents, including:

• Analysis of events and alerts
• Support in containment, eradication, and recovery
• Documentation of incidents and lessons learned

Support security monitoring activities (SIEM, EDR, logs, alerts, etc.) Contribute to the analysis and design of Information Security architecture, considering:

• Access controls
• Network segmentation
• On-premises and/or cloud environments

Support risk assessments and recommendations for technical controls Act as a technical support point for internal areas, vendors, and clients, translating technical topics into clear language Support the implementation and continuous improvement of security processes, policies, and controls Work closely with technical leadership, participating in strategic discussions and the evolution of the security model

Requirements and qualifications

• Degree in IT or related areas
• Advanced English (for conversation)
• Previous experience (even if initial) with Information Security
• Experience in security incident response (phishing, malware, improper access, information leakage, etc.)

Knowledge in:

• Information Security architecture fundamentals
• Networks (firewalls, VPN, segmentation)
• Access and identity controls
• Familiarity with security tools (e.g., SIEM, EDR, corporate antivirus, firewalls)
• Notions of frameworks and best practices (ISO 27001/27002, NIST, CIS)

Behavioral requirements

• Good communication and interpersonal skills
• Ability to deal with different profiles (technical and non-technical)
• Organization, sense of responsibility, and analytical posture
• Desire to learn, evolve technically, and receive guidance
• Ability to work under guidance, but with progressive autonomy

Differentials

• Experience with cloud environments (AWS, Azure, or GCP)
• Participation in audits or security projects
• Knowledge in governance, risk, and compliance (GRC)
• Differential: ISO27001:2022 internal auditor or similar

Additional information Work location: São Paulo - SP - working at the client's site. Schedule: Monday to Friday, business hours. Contract type: Pessoa Jurídica (PJ).