Staff GRC Program Manager

Act as the operational lead for cybersecurity governance, risk management, and compliance in Brazil, working directly with local leadership on the entity's information security program and incident-response capabilities.

Prepare, coordinate, and directly support local leadership during regulatory authorization reviews, ongoing supervisory engagements, and examinations.

Provide periodic updates to Ripple Brazil's board and management on the InfoSec program, ICT risk posture, and regulatory developments.

Maintain compliance with Brazilian regulatory and security frameworks relevant to virtual asset service providers, including central bank cybersecurity and data protection requirements.

Map new and evolving guidance from the BCB, COAF, and ANPD against Ripple's internal security controls library to identify gaps and opportunities for improvement.

Scope, plan, and independently conduct periodic technical control testing to validate the effectiveness of information security controls across cloud, infrastructure, and application environments.

Directly access systems to pull technical evidence (logs, system settings, access reports) for control testing, audits, and independent assurance reviews.

Collaborate with global InfoSec teams to develop, maintain, and localize InfoSec Policies, Standards, and Procedures for local regulatory and data protection compliance.

Lead local oversight of outsourced IT, custody-adjacent, and security service providers, including third-party due diligence and contingency-planning obligations.

Support Ripple Brazil's Data Protection Officer on security-of-processing matters.

Support group-wide Information Security GRC initiatives, ensuring cross-entity alignment as Ripple's regulated footprint in Latin America grows.

Partner with global Information Security, Engineering, Compliance, Finance, Product, Legal, and Sales teams to provide security guidance that directly impacts Ripple's product security and customer trust in Brazil.

Support regional customer-facing activities, including drafting Brazil-specific security messaging, responding to security due diligence questionnaires, and reviewing customer security contractual language.

Develop and maintain information security policies, standards, GRC process documentation, system workflows, and evidence collection procedures.

Attend and participate in Brazilian and regional digital asset industry events and discussions to stay current on evolving regulation, threats, and best practices.

5+ years of experience in information security risk management and compliance, ideally including direct exposure to a BCB-regulated (or equivalent) financial institution's authorization or examination process.

A Bachelor's Degree in a relevant field or equivalent professional experience.

Based in Brazil, with proven experience in the Brazilian financial or FinTech sector and a strong working understanding of the BCB regulatory landscape.

Solid understanding of the BCB's PSAV/SPSAV framework and familiarity with the LGPD.

Proficiency with common information security frameworks such as ISO 27001, SOC2, NIST, and the CSA Cloud Controls Matrix (CCM).

A proven understanding of information security governance in the context of cloud-native FinTech companies operating in a distributed, fast-moving environment.

Comfortable working independently in technical environments and quickly learning new systems and processes.

Hands-on experience pulling and analyzing technical evidence, including system logs, configuration data, audit reports, and database queries.

Ability to develop clear, audience-tailored documentation, SOPs, and training content.

Experience collaborating effectively with multi-functional teams of engineers, product managers, and compliance experts.

Familiarity with tools such as Jira, Confluence, Okta, AWS, Tines, and integrated GRC platforms.

Fluency in Portuguese and professional proficiency in English.