Information Security Analyst

About ONErpm ONErpm strives to establish its legacy as a global brand that makes an impact on the artistic community, the music business, and society as a whole. We are an inclusive company driven by innovation, music, and technology. We believe in mutual respect and recognize that different perspectives drive innovation, accelerate growth, and lead to more sustainable decisions and results. If you join us, regardless of your location or position, we will support you in doing your best and reaching your full potential. As a pioneering company, ONErpm has captured more than 20% of Brazil’s digital music market in less than 16 years. Today, we operate in Mexico, the United States, Colombia, Argentina, Peru, Chile, Jamaica, Spain, Nigeria, Vietnam, and many other countries. As of May 2026, ONErpm has more than 46 offices across 32 countries, with a presence on nearly every continent. Responsibilities Security in Design: Integrate security requirements and perform threat modeling/project risk analyses in the early stages of system design and feature development (Security by Design) Pipeline & Code Security (AppSec): Implement, operate, and maintain automated security tooling (SAST, DAST, SCA) in CI/CD pipelines; assist software engineers in remediating vulnerabilities using OWASP Top 10 guidelines and secure coding frameworks. Cloud Security Posture: Evaluate, monitor, and improve the security posture of cloud infrastructure and technology environments based on recognized benchmarks such as CIS Controls and cloud security best practices. Privacy & LGPD Compliance: Establish and manage operational workflows for data subject access requests (DSARs), maintain the continuous data mapping lifecycle, and evaluate privacy risks in new product features. Penetration Testing Coordination: Coordinate regular external/internal pentesting procedures, including environment provisioning, scoping requirements between vendors and internal development teams, and managing remediation tracking. Vendor & Third-Party Risk Management: Implement and oversee IT vendor security assessments to evaluate and mitigate the aggregate risks introduced by third-party tools, services, and partners. Security Awareness & Culture: Plan and execute continuous security awareness programs, phishing simulations, and training sessions to build a proactive security mindset across the organization. Incident Management & Root Cause Analysis: Monitor, respond to, and investigate information security and privacy incidents, analyzing root causes and implementing preventative controls. Due Diligence & Audit Response: Conduct and respond to security and privacy due diligence assessments from customers, vendors, and regulatory auditors Metrics & Indicators: Develop, track, and report Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for Information Security and Privacy maturit Compliance & Regulations: Ensure adherence to internal company policies, compliance regulations, industry standards, and workplace health and safety rules pertinent to the position. Requirements Higher Degree (Bachelor’s) in Information Security, Computer Science, Software Engineering, Systems Analysis, or related technology fields. Desirable Certifications: CompTIA Security+, AWS/Azure Security Specialty, Certified AppSec Practitioner (CAP), EXIN Privacy & Data Protection (LGPD/GDPR), or ISO 27001 Lead Implementer/Auditor. Proficiency in SAST, DAST, and SCA tools and their integration into CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Azure DevOps). Solid understanding of the OWASP Top 10, CIS Controls, and cloud security architecture (AWS, GCP, or Azure). In-depth knowledge of the General Data Protection Law (LGPD), data mapping, and DSAR management workflows. Familiarity with third-party risk management (TPRM) frameworks and pentest scoping/vendor management. Solid fundamentals in networking, protocols, identity and access management (IAM), and technology infrastructure. Benefits Health and Dental Insurance Meal Allowance (Groceries) Meal Allowance (Restaurants) Life Insurance TotalPass Birthday Day Off

Security in Design: Integrate security requirements and perform threat modeling/project risk analyses in the early stages of system design and feature development (Security by Design) Pipeline & Code Security (AppSec): Implement, operate, and maintain automated security tooling (SAST, DAST, SCA) in CI/CD pipelines; assist software engineers in remediating vulnerabilities using OWASP Top 10 guidelines and secure coding frameworks. Cloud Security Posture: Evaluate, monitor, and improve the security posture of cloud infrastructure and technology environments based on recognized benchmarks such as CIS Controls and cloud security best practices. Privacy & LGPD Compliance: Establish and manage operational workflows for data subject access requests (DSARs), maintain the continuous data mapping lifecycle, and evaluate privacy risks in new product features. Penetration Testing Coordination: Coordinate regular external/internal pentesting procedures, including environment provisioning, scoping requirements between vendors and internal development teams, and managing remediation tracking. Vendor & Third-Party Risk Management: Implement and oversee IT vendor security assessments to evaluate and mitigate the aggregate risks introduced by third-party tools, services, and partners. Security Awareness & Culture: Plan and execute continuous security awareness programs, phishing simulations, and training sessions to build a proactive security mindset across the organization. Incident Management & Root Cause Analysis: Monitor, respond to, and investigate information security and privacy incidents, analyzing root causes and implementing preventative controls. Due Diligence & Audit Response: Conduct and respond to security and privacy due diligence assessments from customers, vendors, and regulatory auditors Metrics & Indicators: Develop, track, and report Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for Information Security and Privacy maturit Compliance & Regulations: Ensure adherence to internal company policies, compliance regulations, industry standards, and workplace health and safety rules pertinent to the position.

Higher Degree (Bachelor’s) in Information Security, Computer Science, Software Engineering, Systems Analysis, or related technology fields. Desirable Certifications: CompTIA Security+, AWS/Azure Security Specialty, Certified AppSec Practitioner (CAP), EXIN Privacy & Data Protection (LGPD/GDPR), or ISO 27001 Lead Implementer/Auditor. Proficiency in SAST, DAST, and SCA tools and their integration into CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Azure DevOps). Solid understanding of the OWASP Top 10, CIS Controls, and cloud security architecture (AWS, GCP, or Azure). In-depth knowledge of the General Data Protection Law (LGPD), data mapping, and DSAR management workflows. Familiarity with third-party risk management (TPRM) frameworks and pentest scoping/vendor management. Solid fundamentals in networking, protocols, identity and access management (IAM), and technology infrastructure.

Health and Dental Insurance Meal Allowance (Groceries) Meal Allowance (Restaurants) Life Insurance TotalPass Birthday Day Off