IT Governance, Security, and FinOps Specialist

• Establish and maintain Information Security and FinOps governance processes, including policies, roles, metrics, and review cadence
• Lead the vulnerability management process by consolidating findings from scanning tools and CVE advisories, classifying severity, assigning issues to the responsible teams, and tracking remediation deadlines
• Organize and provide administrative support for the Security and Cost (FinOps) committees, preparing agendas and materials, recording decisions, and tracking action plans through completion
• Follow up with and hold managers and squads accountable for outstanding security and cost-related items, escalating significant risks and delays to leadership
• Consolidate and segment cloud costs by squad and product, monitor tagging and actual spending versus budget, and identify variances and optimization opportunities
• Prepare executive reports and dashboards on vulnerabilities, compliance, and costs, presenting them monthly to the technology steering committee
• Keep policies, controls, and evidence up to date for audits, customer assessments, and compliance with Brazil’s LGPD data protection law
• Serve as the coordination point between engineering, infrastructure, product, and leadership, promoting adherence to governance processes

• Experience in IT Governance, GRC, or Information Security management, preferably in technology companies with cloud environments
• Knowledge of the vulnerability management lifecycle, including CVEs, CVSS, risk-based prioritization, and remediation deadlines
• Ability to interpret reports from scanning tools and discuss findings with technical teams
• Familiarity with FinOps and cloud billing, including cost allocation, tagging, reserved instances, and budget tracking
• Experience leading committees and governance rituals, with action-plan follow-up
• Advanced skills in data organization and analysis using spreadsheets and BI tools
• Strong communication skills and an assertive approach to following up on deadlines and aligning priorities with managers and technical teams
• Organized and process-oriented profile, with the autonomy to build processes from the ground up
• Knowledge of frameworks such as ISO 27001, NIST CSF, CIS Controls, COBIT, or ITIL
• Certifications such as FinOps Certified Practitioner, ISO 27001 Lead Implementer or Lead Auditor, CompTIA Security+, or CISM
• Experience with security tools such as Snyk, SonarQube, Trivy, Dependabot, or similar solutions
• Experience with cloud cost management tools such as AWS Cost Explorer/CUR, GCP Billing, or similar solutions
• Knowledge of SQL for data extraction and cross-referencing
• Experience with Jira or similar tools for managing outstanding items and action plans
• Experience supporting LGPD compliance and responding to customer security questionnaires
• Extensive experience and in-depth knowledge of Spring Boot and the Spring ecosystem
• Experience building unit and integration tests using JUnit
• Experience with relational and in-memory databases; knowledge of NoSQL databases is a plus
• Knowledge of Spring Boot, Spring Data, Spring Cloud, Spring Security, JPA, and Hibernate
• Knowledge of Spring Cloud Function
• Experience with message brokers

• Remote work
• Position also open to candidates with disabilities