IT Security & Compliance Lead

Job Overview

This is a Full-Time Role (40 hours per week, 5DWW) with no option for part-time work. While this is a remote-first opportunity, the candidate filling this role must be a resident of Brazil at the start of employment. Additionally, they must be within commuting distance of São Paulo.

About the Team

The Technology & Data portfolio provides the digital infrastructure, engineering and data capabilities that enable effective delivery, innovation and learning across the B Lab Global Network. Infrastructure & Information Management (Operational Technology) is responsible for information security, workforce enablement and the adoption of digital tools across the network.

About the Opportunity

B Lab is seeking an IT Security & Compliance Lead to own security governance across the global network. Consolidation increases security exposure as organizations with different controls come together, and this role exists to set a consistent baseline and raise our security posture proactively rather than reactively.

Core Responsibilities

• Security Governance, Audits, and Assessments
  • Conduct regular security audits and risk assessments of network systems, applications and processes, and maintain a prioritized risk register
  • Establish and maintain a security baseline across the network, aligned to a recognized framework (for example ISO/IEC 27001:2022)
  • Track and report security posture and maturity over time to the Technology leadership team, with clear metrics
  • Run security reviews of new and existing vendors and technology platforms (third-party risk), including SaaS tools used by regional and market teams
  • Coordinate external penetration testing and vulnerability scanning, and track remediation with system owners
• Identity, access and platform security
  • Define and monitor access control standards (MFA, SSO, least privilege, joiner/mover/leaver processes) across core platforms such as Google Workspace and Salesforce
  • Partner with Regional IT Administrators on endpoint and device security standards for a distributed, remote-first workforce, moving toward a zero-trust model
  • Advise Product & Platform Engineering on secure-by-design practices for B Lab's digital
• Security policy development and awareness
  • Own and maintain the information security policy set (including the Information Security, Backup & Recovery and Security Incident Management policies) and the standards and procedures that support it
  • Refine policies as the network consolidates, and communicate changes clearly to staff across regions and languages
  • Own the network-wide security awareness program (KnowBe4), including training, phishing simulations and completion reporting
  • Contribute the security perspective to the B Lab AI Policy and to the safe adoption of AI tools
• Incident response and resilience
  • Own and maintain the incident response plan, covering detection, escalation, containment, communication and post-incident review
  • Serve as lead coordinator during security incidents, working with Legal, Communications and affected regions
  • Support business continuity and disaster recovery planning, including testing backup and recovery procedures
• Compliance and risk management support
  • Support data protection compliance across the regions where B Lab operates (for example GDPR, UK GDPR and Brazil's LGPD), in partnership with Legal and the Data Governance Lead
  • Partner with Legal, HR, Finance and other teams on compliance matters, such as data processing agreements, data subject requests and breach notification
  • Maintain documentation and evidence that supports audits, partner and funder due diligence, and regulatory inquiries