RunTalent

Aug 4, 2026

10900 - Cargo: Cybersecurity Specialist, Executor (Blue Team, Red Team, Hardening, SIEM/SOC, and Forensics)

Brazil

Campinas, São Paulo, Brazil

Automatic translation. Check the original.

About the opportunity

Execution on Information Security tools

Implement, configure, integrate, and technically sustain the Holding's security tools, applying policies and parameters defined by the Information Security area.

Execute policy adjustments, rules, signatures, exclusions, and blocking/detection profiles in each technology, with records of changes and evidence of applied configurations.

Ensure effective tool coverage: agent installation and health, uncovered assets, outdated versions, idle licenses, and non-standard environments.

Perform integrations between tools and between these tools and the SIEM and response processes, eliminating telemetry blind spots.

Open, track, and escalate technical support tickets with manufacturers and integrators, technically leading the solution until closure.

Maintain updated technical documentation of configurations, integrations, and operational procedures for the tools under your responsibility.

Blue Team, SIEM, and SOC

Define, for vendor implementation, use cases, correlation rules, and alerts in the SIEM, mapping to MITRE ATT&CK and prioritizing according to asset risk and criticality.

Execute the onboarding of new log sources, validate event normalization, data collection quality and continuity, and handle ingestion failures.

Think strategically about tuning detections and reducing false positives, for the vendor to measure the result before and after adjustments.

Technically monitor the contracted SOC/MDR on a daily basis: validate triage quality, enforce SLA compliance, review playbooks, and escalate deviations in a structured manner.

Think strategically about response automations (SOAR) for the vendor to create and maintain operational runbooks.

Perform Threat Hunting based on threat intelligence and indicators of compromise, converting findings into new detections.

Hardening and Gap Remediation

Apply hardening baselines to the Holding's assets, including operating systems, databases, application servers, containers, network and security equipment, workstations, and cloud environments, executing configurations in conjunction with CSC teams.

Measure asset compliance levels against baselines, identify configuration deviations and drifts, and execute necessary corrections, with evidence of before and after states.

Translate market references (CIS Benchmarks and vendor guides) into configurations effectively applied in the environment, respecting change windows and operational continuity.

Support vulnerability management execution: validate exploitability, apply or coordinate patch application, and technically prove remediation within SLAs defined by asset criticality and exposure.

Execute actions to reduce the internet-facing attack surface, review obsolete rules, and correct insecure configurations identified in diagnostics and audits.

Red Team, Testing, and Control Validation

Conduct internal penetration tests, adversary simulations, and external exposure surface validations within the Holding's environment.

Lead Purple Team exercises, practically testing if implemented controls are effectively detected and responded to.

Technically validate the effectiveness of applied fixes, providing evidence of the result of each remediation.

Support the preparation and monitoring of penetration tests and social engineering exercises contracted from third parties, technically handling the findings.

Consolidate test results into objective reports, including action plans, responsible parties, and deadlines.

Incident Response and Digital Forensics

Technically act in response to cyber incidents within the Holding's environment, executing containment, eradication, and recovery support.

Conduct forensic analyses on endpoints, servers, cloud environments, identities, emails, and network artifacts, ensuring evidence preservation, chain of custody, and auditable documentation.

Perform malicious artifact analysis, timeline construction, log analysis, and root cause determination.

Collect and organize technical evidence required for incident reports and memorandums, audits, and regulatory compliance.

Participate in cyber crisis exercises and recovery tests, executing planned technical activities.

Availability for on-call duty during critical incidents.

Execution of NIST CSF 2.0 Goals

Execute the NIST CSF 2.0 subcategories assigned to this position in the Holding's PDSI roadmap, within the deadlines defined per quarter.

Implement technical controls corresponding to the subcategories under your responsibility, with emphasis on hardening and configuration management (PR.PS-01), authentication and least privilege (PR.AA-03 and PR.AA-05), data protection (PR.DS-10), asset and system inventory (ID.AM-01 and ID.AM-02), and backup integrity verification (RC.RP-03).

Structure and evolve the Detect function of the framework, currently without planned deliverables, by implementing continuous monitoring and adverse event detection capabilities.

Produce and organize technical evidence for each delivered subcategory in a traceable and auditable format to support the maturity score and reporting to Senior Management.

Periodically report on execution status of goals, flagging risks of delay, dependencies, and blockers in advance.

Support contracted consultancies during maturity assessments by providing evidence and executing prioritized technical recommendations.

Interface with CSC and the Holding

Execute technical demands prioritized by the Holding's Information Security Management, maintaining traceability of deliverables.

Coordinate with CSC teams (infrastructure, networks, cloud, endpoint, and service desk) for the execution of necessary changes, respecting change management processes.

Translate corporate directive requirements into configurations and procedures applied in the environment.

Provide technical evidence for internal and external audits and applicable compliance requirements (SOX and LGPD).

Report clearly and objectively on the progress of activities, identified technical risks, and pending items requiring Holding decision.

Languages

10900 - Cargo: Cybersecurity Specialist, Executor (Blue Team, Red Team, Hardening, SIEM/SOC, and Forensics)

About the opportunity

Blue Team, SIEM, and SOC

Hardening and Gap Remediation

Red Team, Testing, and Control Validation

Incident Response and Digital Forensics

Execution of NIST CSF 2.0 Goals

Interface with CSC and the Holding

Show your skills.Get discovered.

More opportunities with one profile

Keep exploring

SRE Observability Lead

Senior Site Reliability Engineer (Observability)

Cloud Operations Manager