About Nu

Nu is the leading digital bank in Latin America, serving 135 million customers across Brazil, Mexico, and Colombia. The company has been leading an industry transformation by leveraging data and proprietary technology to develop innovative products and services.

Guided by its mission to fight complexity and empower people, Nu caters to customers’ complete financial journey, promoting financial access and advancement with responsible lending and transparency. The company is powered by an efficient and scalable business model that combines low cost to serve with growing returns.

Nu’s impact has been recognized in multiple awards, including Time 100 Most Influential Companies, Fast Company’s Most Innovative Companies, and Forbes World’s Best Banks.

Visit our Institutional Page

About the Team

The Non-Financial Risk (NFR) team is part of Risk Management and provides second-line oversight and independent challenge across operational, technology, resilience, reputation and other non-financial risks. The team helps the organization identify, assess, prioritize, respond to, monitor, and communicate risks through consistent frameworks, governance, data, and tooling.

About the Role

Strategic and regulatory, centered on the design and strengthening of the Technology Risk framework, and on overseeing its implementation through the Technology Risk area and the business areas, ensuring comprehensive, forward-looking management aligned with regulation and the company’s strategy.

Supports the oversight and development of the Technology Risk function, defining frameworks, metrics, and guidelines, and supervising the proper management of risks arising from systems, data, infrastructure, and technology third parties. Acts as the main point of contact with governing bodies and regulators on IT Risk matters, coordinates the response to major incidents and technology crises, and helps execute tests, assessments, and monitoring of the technology environment.

You will operate with significant autonomy, influence without formal authority, and accountability for outcomes that directly affect customers, OCC and FFIEC examination readiness, the bank's launch conditions, and Nubank U.S.'s ability to operate securely and in compliance from day one. As an independent second-line function, you set the risk frameworks, methodologies, and standards and then review, challenge, and validate.

You’ll be Responsible for

• Act as a senior individual contributor and the Second Line of Defense (2LoD) subject-matter expert for information security and technology risk at Nubank U.S., providing independent oversight and challenge of the first line.

• Strategize implementation plans with senior partners locally and globally.

• Work with senior colleagues and technical areas to independently assess the root cause of material technology gaps and challenge the adequacy of remediation plans and control-strengthening actions.

• Define, update, and oversee the Technology Risk framework, including policies, standards, methodologies, and assessment and reporting criteria.

• Establish, update, and monitor technology risk metrics (KRIs, RAS), consolidating the view of exposure and trends for governing bodies.

• Lead the preparation of regulatory reports and presentations to committees and governing bodies on Technology and Cybersecurity Risk.

• Prepare responses and coordinate attention to regulatory and audit requests related to Technology Risk, interacting directly with those authorities when appropriate.

• Provide independent oversight and challenge of the management of high-materiality technology and cybersecurity incidents, reviewing classification, root-cause analysis, and the adequacy of corrective actions.

• Independently review and challenge the execution of institutional crisis protocols for technology and cybersecurity incidents, including the adequacy of pre-crisis reporting, internal communications, and coordination across key areas.

• Provide second-line review and challenge of the first line's disaster recovery plans (DRP) and their testing, assessing the adequacy of technology controls and recovery capabilities.

• Independently review and challenge the Business Impact Analysis (BIA), assessing whether the technology dependencies identified by the first line adequately reflect criticality and exposure to Technology Risk.

• Provide guidance and challenge technology risk assessments for new products, features, and architectures, ensuring consistency and completeness.

• Independently review the qual