Sobre esta vaga de Information Security Analyst na Hellmann Worldwide Logistics
About Us
Ready to rock the future with us? At Hellmann we put our people at the heart of everything we do, because for us, relationship matters. Joining us does not just mean becoming part of a global company. It is an invitation to shape the future of the logistics industry together with us. Our Hellmann culture is based on our four values: Caring, Entrepreneurial, Forward-Thinking and Reliable. These values resonate with yours? Then become part of our FAMILY that consists of around 10.000 employees in more than 200 locations worldwide.
For the better. Together.
The Information Security Analyst plays an integral part in the development, implementation, and enforcement of Information Security across Hellmann, with regional responsibility for the Americas (AMCS) and alignment with global security leadership. The primary function is to help protect the organization's systems, networks, and information assets against security breaches, cyberattacks, and unauthorized access, modification, or destruction. The role receives Information Security governance from the Global CISO organization, aligns security protocols for the region, and acts as a bridge between Global Security Governance, Regional IT, and Country IT teams. It combines Information Security Governance, Risk and Compliance (GRC) and policy management with hands-on cybersecurity operations such as vulnerability management, security scanning, and remediation. The Analyst also serves as the first-level interface for customer security inquiries related to Hellmann's Information Security Management System (ISMS) and supports Sales with security-related information in the RFI/RFQ process. In addition, this position acts as a backup to the DevSecOps / secure-delivery Security Analyst, providing coverage for secure-pipeline and production-release security activities.
This is a functional (dotted-line) relationship to the Global CISO organization for information security standards, policy, and governance. The IT Infrastructure Director, Americas retains administrative authority over performance management, prioritization, and resource allocation for this role. Where global security requirements and regional operational priorities conflict, the matter is escalated jointly to the Global CISO and the VP IT Americas for resolution
Essential Duties and Responsibilities:
Information Security Governance, Risk & Compliance (GRC)
▪ Contribute to the development, review, and enforcement of internal Information Security Standards (Policies) across the region.
▪ Drive Governance, Risk, and Compliance (GRC) activities for the region, including risk management, compliance reviews, and control validation.
▪ Identify, quantify, monitor, and report information security risks and perform impact analysis, leveraging the risk quantification controls maintained in Jira.
▪ Conduct security reviews of contracts and agreements, identify security-related legal implications and risks, and escalate concerns appropriately. This review is limited to identifying technical and information-security risk; it does not constitute legal advice or a legal risk determination. Identified concerns are escalated to Legal and/or the Data Protection Officer for legal review and final determination.
▪ Support ISO 27001 and related security framework activities, including framework assessments, governance reviews, and control validation.
Policy & Documentation Management
▪ Review, update, and maintain regional security policies and supporting documentation, ensuring policies remain current ahead of expiration.
▪ Publish and maintain security policies and procedures in SharePoint.
▪ Transform global security policies into regional Standard Operating Procedures (SOPs) that comply with regional and local laws and regulations.
▪ Monitor the regional and local landscape of laws and regulations affecting information security.
Cybersecurity Operations & Vulnerability Management
▪ Coordinate and support vulnerability management, security scanning, and remediation tracking using tools such as Nessus, SAST, and DAST.
▪ Support penetration testing and red team / blue team / purple team activities, and work remediation as identified by the regional and global security teams.
▪ Monitor the health status of Hellmann security systems (e.g., patch management, antivirus, endpoint protection) and report key performance indicators (KPIs) and project status.
▪ Initiate and monitor the implementation of security safeguards in line with global standards and in alignment with the global cybersecurity team.
▪ Validate security tooling outputs and support security control validation for production releases.
Incident Response & Business Continuity
▪ Investigate, document, and report security incidents, supporting impact analysis and coordinated response.
▪ Support the maintenance of the Disaster Recovery Plan (DRP) and the Business Continuity Management (BCM) framework.
Secure Delivery & DevSecOps Support (Backup)
▪ Serve as backup to the DevSecOps / secure-delivery Security Analyst, providing coverage for secure-pipeline and production-release security activities.
▪ This backup relationship is reciprocal: the DevSecOps / secure-delivery Security Analyst serves as backup for this role's GRC, policy, and incident response duties, and continuity coverage for this position is documented in the regional Business Continuity Management (BCM) plan.
▪ Participate in production release readiness reviews, validating security requirements prior to release.
▪ Support the integration of security controls into CI/CD pipelines and collaborate with development and ServiceDesk Ops teams on secure code deployment.
▪ Support SAST/DAST scanning and vulnerability remediation within the software delivery lifecycle.
Global & Regional Security Alignment
▪ Act as a bridge between Global Security Governance, the Global CISO organization, Regional IT, and Country IT teams, aligning regional activities with global standards.
▪ Support global security projects, share best practices, and transfer knowledge across global, regional, and local levels.
▪ Serve as the first-level interface for security-related customer inquiries and support Sales with security-related RFI/RFQ responses, customer security surveys, questionnaires, and audits.
▪ Collaborate cross-functionally with Network, Server, local and country IT teams, regional IT leadership, and global security teams.
Awareness, Training & Guidance
▪ Initiate and coordinate information security awareness and training activities, covering risks, attack patterns, and secure practices.
▪ Provide security guidance to regional and local teams, influence decisions, and escalate security risks appropriately.
▪ Perform other job-related assignments and fulfill responsibilities as required.
Qualifications
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Education and/or Experience
▪ Bachelor's degree (B.S.) in Computer Science, Information Technology, Cybersecurity, or a related field; or an equivalent combination of education and experience.
▪ Minimum of two (2) years of technical experience in Information Security or a related IT security discipline.
▪ Experience with Governance, Risk, and Compliance (GRC) frameworks; including risk management, auditing, and compliance is preferred.
▪ Exposure to DevSecOps and secure delivery practices is a plus; deep DevSecOps experience is not required, as this role supports that function as a backup.
▪ Professional understanding of security standards, vulnerability management, and IT infrastructure.
Language Skills
▪ English is required.
▪ Spanish is recommended and considered an asset for this regional role.
▪ Ability to read, analyze, and interpret complex documents and to respond effectively to sensitive inquiries from managers, staff, and customers.
Technical Knowledge and Certifications
▪ CISSP or other Information Security certifications are welcome but not required.
▪ Knowledge of IT regulations (e.g., GDPR), ISO standards (e.g., ISO 27001), CIS, and NIST.
▪ Familiarity with security tooling such as vulnerability scanners (e.g., Nessus), EDR/NDR, firewalls, Microsoft Intune, and Entra ID.
▪ Familiarity with SAST/DAST tooling and CI/CD security concepts is a plus.
▪ Basic programming/scripting skills (e.g., Python, Bash) for automating security tasks is a plus.
▪ Experience with Kali Linux, Kanban, and Jira is a plus.
Knowledge, Skills & Attributes
▪ Strong sense of ownership and follow-through, with proactive communication.
▪ Strong communication skills, with the ability to translate technical risk into business language for non-technical stakeholders.
▪ Strong analytical and organizational skills and attention to detail.
▪ Process-oriented mindset with the ability to work effectively under pressure.
▪ Positive attitude, humility, teamwork, and a demonstrated willingness to learn and to mentor others.
▪ Ability to adapt and engage in continuous learning to stay current with security practices and tools.
▪ Travel may be required.
Inclusion and social diversity are firmly anchored values in our corporate culture. Regardless of gender, age, any disabilities, religion, ethnic origin or sexual identity: We are looking forward to meeting you!
If you are excited by this fantastic opportunity and have what it takes, then click APPLY!
