Consultor Risco de Informação Sr.

Location: Sao Paulo Office

Time Type: Full time

Job Description

Do you want your voice heard and your actions to count?

Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.

With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.

Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.

Professional experience desired for the position

At least 8 years of experience in Information Security or Information Risk roles.

Education

Bachelor's degree in Information Technology, Information Security, Computer Science, or a related discipline.

Advanced english.

Primary responsibilities of the position

Act within the second line of defense—Risk Management—to coordinate activities related to cyber risk (IT Risk, Cyber Risk, Third-Party Risk Management, and Business Continuity Management), providing oversight to First Line of Defense (FLoD) activities, while maintaining ongoing alignment with the IT and Information Security departments as well as Americas Information Risk team. Lead cyber risk reporting to the Integrated Risk Committee, monitor relevant risk metrics (RAS, KRIs and KPIs), review policies, procedures and audit issues evidences, perform review and challenge activities, and prepare regulatory reports.

Required technical knowledge, skills, and certifications for the role.

Knowledge of risk and security structures, frameworks, and industry best practices (NIST, SANS, FFIEC, etc.);

Knowledge of security appliance management (SIEM, FW, IDPS, WAF, etc.), monitoring, vulnerability management, access management, and endpoint solutions (EDR, DLP, etc.);

Knowledge of regulations and resolutions applicable to the area — CMN Resolution No. 5,274/25, CMN Resolution No. 4,557/17, and Law No. 13,709/18 — the Brazilian General Data Protection Law (LGPD);

Knowledge of other security and risk domains, such as offensive security, DevSecOps, security incident response and crisis management, operational risk, and internal controls is desirable.