Staff GRC Program Manager
Core
Operational lead for cybersecurity governance, risk management, and compliance in Brazil, supporting Ripple's regulated digital asset activities and local entity authorization.
Role type
Staff GRC Program Manager (Information Security)
Builds
Local operational presence and governance for Ripple's Brazil entity as a Virtual Asset Service Provider (SPSAV/VASP).
Domain
Financial services / Digital Assets / Cybersecurity / Regulatory Compliance
Required skills
Information security risk management, Regulatory compliance (Brazilian financial sector), Cloud security controls, Third-party risk management, Technical control testing, Policy development, Incident response coordination, Stakeholder management, Documentation, Cross-functional collaboration
Preferred skills
BCB-regulated financial institution experience, LGPD framework knowledge, ISO 27001/SOC2/NIST/CCM frameworks, Cloud-native FinTech environment experience, Technical evidence analysis, Portuguese fluency, English professional proficiency
Technologies
Jira, Confluence, Okta, AWS, Tines, GRC platforms
Responsibilities
Serve as operational lead for cybersecurity governance, risk management, and compliance in Brazil; Prepare and coordinate regulatory authorization review and supervisory engagements; Provide periodic updates to board and management on InfoSec program and regulatory developments; Map new regulatory guidance to internal security controls; Conduct periodic technical control testing and pull technical evidence; Collaborate with global teams to localize InfoSec policies and standards; Lead local oversight of outsourced IT and security service providers; Support Data Protection Officer on security-of-processing matters; Partner with global teams to provide security guidance impacting product security; Support regional customer-facing security activities; Develop and maintain GRC process documentation and evidence collection procedures; Attend industry events to stay current on regulation and threats.
Seniority
Staff, hands-on IC with strategic oversight