Grupo QuintoAndar | Information Security Specialist - IAM

About Grupo QuintoAndar We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience. With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year. Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/ . Location & Remote Work Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week. About the Team The IAM team is at the core of QuintoAndar's platform security. We build and maintain the systems that guarantee the right people and the right services have access to the right resources at the right time. We handle millions of authentication requests daily, and our services are the foundation of trust for the entire QuintoAndar ecosystem. Responsibilities The Challenge At QuintoAndar, identity is our primary security perimeter. We are looking for a Sr. IAM Governance Analyst to evolve our access governance from a traditional, manual model to a "Continuous Compliance" ecosystem. You won't be a traditional auditor focused merely on checking spreadsheet boxes. Your role will be strategic: designing access models (RBAC/ABAC), defining Segregation of Duties (SoD) matrices, and bridging the gap with our IAM Engineering team to transform security policies into automated controls (Paved Roads) using platforms like Okta. Your Responsibilities: Control & RBAC Design: Lead the modeling and standardization of Role-Based Access Control (RBAC) profiles and Segregation of Duties (SoD) for critical systems and infrastructure. Lifecycle Management (JML): Design the business rules for Joiner, Mover, and Leaver (JML) processes, ensuring the principle of least privilege without creating operational bottlenecks. Compliance Automation (UAR): Orchestrate User Access Review (UAR) campaigns. Instead of manual processes, you will work closely with engineering to parameterize Okta and IAM Ecosystem, reducing friction and operational overhead for business managers. Strategic Bridge: Act as the primary translator between Audit/GRC areas (SOX, LGPD, NIST) and technical Engineering squads (IAM/InfraSec), converting legal/regulatory requirements into actionable engineering user stories. Continuous Auditing: Map residual risks in the identity ecosystem, develop actionable KPIs/KRIs, and proactively work with business units to mitigate orphaned accounts and over-provisioning. Security Awareness & UX: Ensure IAM policies not only protect the company but also offer a seamless user experience for employees, adding friction only where strictly necessary. What We Are Looking For (Requirements): Solid, hands-on experience with IAM Governance principles: RBAC, ABAC, SoD, Least Privilege, and JML workflows. Direct experience with the governance and parameterization of IGA and CIAM/Workforce platforms, such as SailPoint IdentityNow, Okta, CyberArk or others. Engineering/Product mindset: The ability to look at manual governance processes and propose scalable, automated solutions. Experience acting as the interface between business teams, external auditors, and software/security engineering teams. Applied knowledge of security and compliance frameworks (NIST CSF, SOX, ISO 27