Grupo QuintoAndar | Senior Information Security Specialist (GRC)

About Grupo QuintoAndar We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience. With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year. Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/ . Location & Remote Work Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week. Hiring Process Stages The stages of our hiring processes aim to assess your experiences and allow you to meet our teams and explore career opportunities. They are structured as follows: Tech Screening Technical interviews People Interview Hiring Committee About the Team We are looking for a senior person to act in the evolution of the Information Security GRC discipline, focusing on transforming risks, controls, and requirements into practical business decisions. This is not a position for someone focused only on frameworks, audits, or documentation. We are looking for someone strong in GRC, but with the technical repertoire to discuss controls, architecture, third parties, identity, data, cloud, and technology in practice. The goal of this position is to increase the company's security maturity, bring more quality to risk decisions, and ensure that governance and compliance processes are useful in practice, and not just correct on paper. What we expect from this position We expect someone who connects Information Security risks to the business context and transforms this into practical action. Someone who moves well between executive and technical discussions, can structure and evolve governance and risk management processes, conducts consistent assessments, orchestrates the evolution of teams, and supports decisions with clarity, credibility, and a focus on results. We are looking for a profile that goes beyond compliance on paper, understands controls in practice, evaluates their effectiveness, and has the seniority to act on different fronts of the team, such as cyber risks, policies and standards, third-party risk, executive indicators, awareness, incident governance, cyber resilience, and Information Security strategic planning. Responsibilities Act in the evolution of the Information Security strategic plan, based on risk exposure, maturity level, market benchmarks, and business impact. Conduct the information security risk management process end-to-end, including identification, assessment, prioritization, treatment, acceptance, monitoring, and executive reporting, in alignment with the company's Risk Management framework. Lead or support key team fronts, such as policies and standards, third-party cyber risk, incident governance, AI governance, cyber resilience, and awareness programs. Conduct maturity assessments and evaluations based on frameworks such as NIST CSF 2.0, ISO 27001, CIS, and SOX, transforming diagnoses into executable action plans. Define and monitor indicators, governance forums, committees, and executive materials that provide visibility into risks, controls, projects, and maturity evolution. Work in partnership with technical and corporate teams to evaluate controls, coordinate remediations, monitor audits and projects, and support the evolution of Information Security maturit