Senior Security Engineer - GRC (PCI)

About Nu

Nu serves more than 140 million customers, guided by a mission to fight complexity and empower people. The company has been leading an industry transformation through innovative products and human-centered services.

Proprietary technology and data at scale power Nu’s digital platform, built to promote financial access, advancement, and transparency. Its business model thrives on customer love and lower costs, feeding a flywheel of growth and profitability.

Visit our Institutional Page

About the role

The Governance, Risk and Compliance (GRC) team enables Nubank to remain compliant with legal, regulatory, and internal requirements, while continuously identifying, classifying, and monitoring risks and providing strategic insights and performance evaluation to leadership. We collaborate with multidisciplinary teams to align our technology security strategy with Nubank’s overall business objectives, embedding security in business decisions so that Nubank can grow safely.

We make sure identified risks are mitigated and that leaders, inside and outside the IT and Security Business Unit, can make decisions based on risk. The focus of the security compliance squad is to ensure Nubank complies with regulations across countries and entities, and holds PCI DSS certifications, alongside other frameworks.

You will be responsible for

• Provide operational support and act as a focal point for the assigned certification scope.

• Interpret certification requirements applicable to your scope and execute and coordinate recurring tests required by the certification.

• Register, manage, and track action plans arising from audit findings or identified gaps.

• Maintain a day-to-day interface with audited and external teams on control implementation, scope alignment, evidence collection, and deadline agreement.

• Propose and implement improvements in internal certification processes.

• Build and maintain strong partnerships with product, engineering and IT teams to make audits and assessments smoother and less disruptive.

• Collaborate with Engineering, Product, IT and global teams to integrate compliance requirements into processes and systems.

We are looking for a person who has

• Solid knowledge across cybersecurity domains and frameworks such as PCI DSS, SOC2, DORA, NIST and similar standards.

• Prior experience supporting security certification or audit processes, including end-to-end management, scoping, and evidence collection.

• Experience with internal controls, compliance functions, and action plans follow up arising from audit findings or identified gaps.

• Experience evaluating and implementing controls in cloud environments (for example AWS, GCP, Azure).

• Strong analytical skills to interpret complex data and turn findings into actionable insights.

• Strong communication skills to translate complex technical concepts.

• Comfort using AI and automation as the default way of working, while validating outputs critically.

• Advanced English, written and spoken, for work with global teams and external assessors. Spanish is a plus.

Nice to have

• Certifications such as PCI ISA or PCIP, CISA, CISM or CISSP.

• Experience in a regulated fintech or financial services environment.

• Experience with multi country or multi entity certification programs.

Location for this opportunity (City, Country)

• São Paulo, Brazil

• Campinas, Brazil

• Rio de Janeiro, Brazil

• Belo Horizonte, Brazil

Benefits

• Chance of earning equity at Nubank

• Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)

• Public Transportation Commuting Benefit (Vale-Transporte)

• NuCare – Psychological, Financial and Legal Assistance Program

• Life Insurance

• Medical Plan

• Dental Plan

• NuLanguage – Language Course Program

• Nucleo - Our learning platform of courses

• Extended Parental Leave

• Daycare Allowance

• Parental Consultancy

• Work-from-home Allowance

• Gym Partnerships

• 30 days of paid vacation

• Relocation Assistance Package, if applicable

Work Model for this Role

Hybrid 2-3 times/week: Our hybrid work model brings us to the office at least twice a week, on strategic days designed to maximize team connection and collaboration. For more details, visit

Our recruitment process may involve the use of artificial intelligence–enabled tools, such as automated interview transcription and analysis, to support the evaluation process. Artificial intelligence is not used to make final hiring decisions; all decisions are made by human reviewers.

To maintain a consistent and fair process for every candidate, Nu does not provide individualized technical feedback. See how our policy works here