Information Security Governance Manager

About this role

<div>At EBANX, you’ll help expand access to payments and technology in some of the world’s most dynamic markets. We’re a <strong>unicorn-status fintech</strong>, <strong>AI-powered</strong>, and scaling fast across <strong>29 countries and counting</strong>.</div> <div><br>Our platform connects leading global companies to more than <strong>1 billion consumers</strong>, enabling seamless cross-border payments where it matters most. We build with purpose, move with speed, and create solutions that are both innovative and inclusive.</div> <div><br>If you’re looking to be part of a company that’s transforming the future of payments with <strong>clarity</strong>, <strong>ambition</strong>, and <strong>real-world impact</strong> — we’d love to meet you.</div> <div> </div> <div><br><strong>Your day-to-day impact:</strong></div> <ul> <li>Lead and develop a high-performing Information Security team focused on Risk Management and Security Governance;</li> <li>Drive the identification, assessment, prioritization, and treatment of information security risks, ensuring clear visibility and effective communication of risk exposure to senior leadership;</li> <li>Oversee the implementation, maintenance, and continuous improvement of compliance programs and certifications, including ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27018, and PCI DSS;</li> <li>Define and maintain the Information Security governance framework, including policies, standards, procedures, and control oversight;</li> <li>Coordinate internal and external audits, security assessments, and the execution of remediation and risk treatment plans;</li> <li>Define, monitor, and report security KPIs, KRIs, and program effectiveness metrics, providing actionable insights to business and executive stakeholders;</li> <li>Drive the organization's security awareness and culture strategy through training programs, phishing simulations, targeted campaigns, and employee engagement initiatives;</li> <li>Partner with cross-functional teams (Legal, Risk, HR, Engineering, Product, and Compliance) to embed security and risk management practices into business processes and strategic initiatives;</li> <li>Ensure security requirements are incorporated into new products, services, vendors, and third-party relationships from the earliest stages of engagement;</li> <li>Provide regular reporting on security governance, compliance status, risk landscape, and strategic initiatives to leadership and relevant governance forums;</li> <li>Foster a culture of accountability, continuous improvement, and security-first decision-making across the organization.</li> </ul> <div><br><strong>Must-haves to shine in this role:</strong></div> <ul> <li><strong>Proven experience leading teams</strong>, with the ability to motivate, coach, and develop people;</li> <li><strong>Strong expertise in Information Security Risk Management</strong>, including risk identification, assessment, prioritization, treatment, and executive-level reporting;</li> <li><strong>Deep knowledge of Information Security Governance and Compliance</strong>, including risk management, internal controls, and security frameworks;</li> <li><strong>Hands-on experience with global standards and certifications</strong> such as ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27018, and PCI DSS;</li> <li><strong>Strong communication skills</strong>, with the ability to translate technical risks into business impacts for both technical and executive audiences;</li> <li><strong>Proven track record managing audits, assessments, and external regulatory demands;</strong></li> <li><strong>Analytical mindset with a business-oriented approach</strong>, connecting security decisions, risk exposure, and compliance requirements with strategic goals;</li> <li><strong>Experience designing and running awareness programs</strong> that go beyond checklists and truly shift culture;</li> <li><strong>Passion for innovation and AI-driven efficiency</strong>, with a proactive approach to leveraging AI and automation to optimize processes, reduce operational overhead, and enhance operational effectiveness;</li> <li><strong>Advanced English</strong> — you’ll often interact with international stakeholders.</li> </ul> <div><br><strong>Bonus points if you have:</strong></div> <ul> <li>Advanced certifications in Information Security, Risk Management, or Governance, such as <strong>ISO/IEC 27001 Lead Auditor/Lead Implementer, CRISC, CISM, CISSP</strong>, or similar;</li> <li>Experience working in <strong>global or multicultural environments</strong>, with distributed teams and international operations;</li> <li>Familiarity with additional governance and risk frameworks such as <strong>NIST CSF, COBIT, SOX, or third-party risk management programs</strong>;</li> <li>Knowledge of <strong>cloud security standards</strong> (e.g., AWS, GCP, Azure) and secure development practices;</li> <li>Hands-on experience with <strong>awareness platforms</strong> (e.g., <strong>KnowBe4</strong>, Wombat, MetaCompliance) and <strong>phishing simulation tools;</strong></li> <li>Experience <strong>presenting security and risk topics to executive committees</strong>, boards, or senior…