Staff GRC Program Manager (Fintech)

Location: São Paulo, Brazil; hybrid with in-office collaboration for 10+ days per month

Company

hirify.global develops crypto solutions for financial institutions, businesses, governments, and developers, supporting regulated digital asset activities and global financial infrastructure.

What you will do

• Lead cybersecurity governance, risk management, compliance, and incident-response capabilities for hirify.global’s Brazil entity.
• Support regulatory authorization reviews, supervisory engagements, examinations, and reporting to the Brazil board and management.
• Maintain compliance with Brazilian virtual-asset, cybersecurity, and data-protection requirements, mapping BCB, COAF, and ANPD guidance to internal controls.
• Plan and conduct technical control testing across cloud, infrastructure, and application environments, including collection and analysis of logs, configurations, access reports, and other evidence.
• Develop and localize information security policies, standards, procedures, workflows, and evidence-collection processes with global InfoSec teams.
• Oversee relevant outsourced IT, custody-adjacent, and security providers; support customer security reviews, contractual language, and regional digital-asset activities.

Requirements

• 5+ years of information security risk management and compliance experience, ideally including authorization or examination work for a BCB-regulated or equivalent financial institution.
• Bachelor’s degree in a relevant field or equivalent professional experience.
• Based in Brazil, with experience in the Brazilian financial or FinTech sector and a strong understanding of the BCB regulatory landscape.
• Understanding of the BCB PSAV/SPSAV framework and familiarity with LGPD.
• Proficiency with ISO 27001, SOC 2, NIST, and CSA Cloud Controls Matrix frameworks.
• Experience with information security governance in cloud-native FinTech environments and ability to work independently in technical systems.
• Hands-on experience analyzing technical evidence, including system logs, configuration data, audit reports, and database queries.
• Ability to create audience-tailored documentation, SOPs, and training content and collaborate with engineering, product, and compliance teams.
• Familiarity with Jira, Confluence, Okta, AWS, Tines, and integrated GRC platforms.
• Fluency in Portuguese and professional proficiency in English required.

Nice to have

• CISSP, CISM, CISA, or AWS Certified Security certification.

Culture & Benefits

• Fast-paced startup environment with experienced industry leaders and a professional development budget.
• Managers and teams can decide which 10+ days per month they work in the office; team offsites and company events are also provided.
• Full-time employees receive competitive salary, bonuses, equity, healthcare, retirement, family-support benefits, and a mobile phone stipend.
• Benefits include R&R days, vacation flexibility, wellness reimbursement, parental leave, family-planning support, and onsite and virtual wellness programming.
• Additional benefits include catered lunches, stocked kitchens, employee-giving match, and team activities.