Responsible for:• Supporting the development, adequance and implementation of information security controls with best practices, standards and regulations followed by the company including NIST CSF, CIS Controls, ISO/IEC 27001/02, Circular 638 and PCI DSS;• Creating and reviewing information security policies, standards and procedures adapting them to the references followed by the company;• Execute information security risk assessment giving directions on how to treat them to reduce the impact for the company, in case the risk materialized;• Making assessment and directions to improve information security processes (Data Loss Prevention, Information Security Awareness, Information Classification...);• Following up the treatment of improvements and risks identified;• Executing regulary simulation phishing campaigns;• Support the creation and improvement of information security awareness materials;• Generate and follow up information security processes indicators;• Resolve problems and improvements together with the technologies vendors used by GRC team.

• Responsible for acting as one of the key focal points in maintaining the PCI/DSS certification program for Stone Group companies.• Identifying opportunities for improvements in implemented controls and providing guidance when relevant

Responsible for academic review - adaptation for 100MBA - SGO consisting of three modules:Introduction to CybersecurityCybersecurity & GovernanceCyberlaw - Technology, Innovation, and Security"

Led the Risk & Compliance team in:- Involvement in information security and privacy compliance and adaptation projects in various business sectors (healthcare, technology, recycling, finance, etc.).- Monitoring, developing, and critically analyzing Controls, Policies, Processes, Standards, and Procedures aimed at information security, protection, and privacy.- Suggesting improvements and preparing technical and executive reports for the project in question.- Maintaining the internal Information Security and Privacy Management System.- Collaborating with internal stakeholders to identify, assess, and address security and privacy risks.- Monitoring and managing security control indicators.- Providing guidance on corrective and preventive actions based on control performance indicators.- Executing projects based on industry standards, frameworks, and best practices (ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005, CIS Controls, NIST CSF, ITIL, among others).

The same activities and responsibilities described above but in a more hands-on/consultant role.

- Worked with a large-scale client on the implementation and maintenance of the service management system (ISO/IEC 20000):➢ Supported the creation of policies, procedures, process execution, and evidence required by the standard, using ITIL- recommended best practices.➢ Conducted audits on processes to identify non-conformities and improvement opportunities.➢ Provided training on service management system processes, service design and transition, service delivery, relationship, resolution, and control for process owners and relevant stakeholders.➢ Conducted a comprehensive risk analysis across the project scope, encompassing technical, organizational, physical, and other assets.- Assisted a large-scale client in an identity and access management project using internal tools.

- Internal assessments focused on PCI DSS certification processes.- Identification and mitigation of risks related to the company's information assets.- Ongoing mapping of Information Security improvements after integration with Neus Tecnologia.- Support in restructuring the Information Security Policy.

- Involvement in activities related to the development and maintenance of the Information Security Management System to meet PCI DSS requirements.- Creation and maintenance of awareness, training, and education programs in information security.- Restructuring of security hardening processes for Windows and GNU/Linux servers (Windows Server, Debian, Red Hat, CentOS, Ubuntu).- Restructuring of update management processes for servers and workstations.- Support in the restructuring of the Secure Development Policy.

- Preventive and corretive maintenance activities for hardware and software;- Resolving basic issues in the computer lab network. -Providing user support in the use of systems.