IT Risk Senior Specialist

About Nu Nu is the leading digital bank in Latin America, serving 135 million customers across Brazil, Mexico, and Colombia. The company has been leading an industry transformation by leveraging data and proprietary technology to develop innovative products and services. Guided by its mission to fight complexity and empower people, Nu caters to customers’ complete financial journey, promoting financial access and advancement with responsible lending and transparency. The company is powered by an efficient and scalable business model that combines low cost to serve with growing returns. Nu’s impact has been recognized in multiple awards, including Time 100 Most Influential Companies, Fast Company’s Most Innovative Companies, and Forbes World’s Best Banks. Visit our Institutional Page About the Role Strategic and regulatory, centered on the design and strengthening of the Technology Risk framework, and on overseeing its implementation through the Technology Risk area and the business areas, ensuring comprehensive, forward-looking management aligned with regulation and the company’s strategy. Supports the oversight and development of the Technology Risk function, defining frameworks, metrics, and guidelines, and supervising the proper management of risks arising from systems, data, infrastructure, and technology third parties. Acts as the main point of contact with governing bodies and regulators on IT Risk matters, coordinates the response to major incidents and technology crises, and helps execute tests, assessments, and monitoring of the technology environment.

Define, update, and oversee the Technology Risk framework, including policies, standards, methodologies, and assessment and reporting criteria. Establish, update, and monitor technology risk metrics (KRIs, RAS), consolidating the view of exposure and trends for governing bodies. Prepare responses and coordinate attention to regulatory and audit requests related to Technology Risk, interacting directly with those authorities when appropriate. Oversee the management of high-materiality technology and cybersecurity incidents, including proper classification, root-cause analysis, and definition of corrective actions. Provide guidance and challenge technology risk assessments for new products, features, and architectures, ensuring consistency and completeness. Design and maintain IT Third-Party Risk frameworks, aligned with institutional standards and regulatory requirements. Oversee the quality and consistency of IT and cybersecurity control testing, technology RCSAs, and incident monitoring. Act as a key advisor to the leadership of Risk, Engineering, Security, Data, and other areas, fostering a strong culture of Technology Risk management.

Minimum of 5-6 years of experience in cybersecurity or IT Risk Management. Bachelors’ degree in Engineering, Computer Science, Information Technology, a Risk Management related field, or equivalent experience. In-depth knowledge of IT and cybersecurity risk management concepts, practices and methods. Understanding of cloud computing models such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Familiarity with cloud providers like Amazon Web Services (AWS) and serverless technologies. Understanding of cybersecurity concepts such as confidentiality, integrity and availability, supply chain risks, cryptography, endpoint and network security, cloud security, mobile security, API security, Cyberincident management, etc. Understanding of DevOps practices and tools used in cloud environments, such as continuous integration/continuous deployment (CI/CD) pipelines and containerization. Understanding of Business Continuity and Disaster Recovery (BC/DR) practices, along with experience executing and coordinating the full Business Continuity Management lifecycle and contingency response. Fluent in English and Spanish, with exceptional communication