Security Product Specialist – Business, Product, Deep Technical Expertise

Role Overview

• Lead strategy and evolution of security products applied to platforms and digital journeys, with a focus on business value, risk reduction, adoption, and scale.
• Define and support vision, positioning and roadmap for trust-based security platforms (e.g., Identity, API Protection, Hardening, Secrets/Keys, Trust Services), ensuring alignment with stakeholders in Business, Risk, Legal, Operations and Engineering.
• Translate business needs into product and technical requirements: PRDs, epics, user stories, acceptance criteria and NFRs (SLA/SLO, auditability, resilience, privacy), ensuring clarity for development teams.
• Institutionalize standards and specifications as product capabilities and non-functional requirements: OWASP ASVS/API Security, CIS Benchmarks, OAuth 2.0, OpenID Connect, JWT, SAML, SCIM and NIST SP 800-63.
• Be the reference for Identity Security products, driving product decisions for authentication, authorization, SSO, MFA, session management, tokens, application onboarding and integrations (internal and/or with customers/partners).
• Structure business cases and monetization models (where applicable): packaging (tiers), pricing, unit economics, TCO/ROI, chargeback/showback, plus value propositions and competitive differentiators.
• Conduct discovery and validation with customers/internal users, prioritizing the backlog by impact (revenue, margin, risk, operational efficiency, experience) and reducing adoption friction (time-to-integrate and time-to-value).
• Define and enable enablement strategies (documentation, integration guides, reference implementations, SDKs and reusable patterns) in partnership with engineering, accelerating adoption and standardization.
• Define requirements and roadmap for Key & Secret Management and Trust Services products: Vault/Secret Managers, policies, rotation, segregation, auditability and automations; and HSM/KMS/PKI: custody, mTLS, lifecycle, encryption and operational governance.
• Guide the evolution of hardening and secure-by-default as an offering/capability, influencing secure baselines in cloud/Kubernetes (policies, networking, workloads, supply chain) with tangible, measurable deliveries.
• Elevate DevSecOps maturity as a product/platform capability, with automations, quality gates, systematic risk reduction, metrics and standards governance.
• Prepare and run RFPs and RFIs with vendors.
• Act in critical incidents (especially identity and access) from a product perspective: impact assessment, prioritization, communication, RCA and structural roadmap changes to prevent recurrence.
• Lead by influence and mentor analysts/POs/consultants, increasing autonomy, consistency and quality in security product specification and delivery.

Requirements

• Strong experience in product/strategy roles (Product Manager, Product Specialist, Senior PO or equivalent) in platform and/or security contexts, connecting business needs to technical execution.
• Proven ability to build and defend business cases and prioritize by value (ROI, TCO, risk, operational cost, impact on conversion/experience, adoption metrics).
• Strong skill in translating between business and engineering: writing PRDs/epics/stories and detailing NFRs (security, privacy, availability, auditability, performance) with clear acceptance criteria.
• Deep experience with identity and protocols: OAuth 2.0, OpenID Connect, JWT, SAML, SCIM and best practices aligned with NIST SP 800-63 — sufficient to discuss flows, threats, trade-offs and requirements.
• Applied knowledge of security standards for applications and APIs (e.g., OWASP ASVS/API Security) and the ability to translate standards into product capabilities and features (e.g., controls, policies, SDKs, automations).
• Technical familiarity to discuss with engineering topics such as: – authentication/authorization architecture, SSO/MFA, sessions and tokens; – integrations, SDKs, reusable patterns and reference implementations; – observability, auditability and trails as product requirements.
• Practical/functional knowledge of Vault/Secret Managers and secret lifecycle (policies, rotation, segregation, auditability, automation).
• Practical/functional knowledge of HSM/KMS/PKI and applied cryptography (mTLS, certificate lifecycle, custody, signing, encryption) — including the ability to discuss security vs. performance trade-offs.
• Familiarity with cloud/Kubernetes and hardening concepts (baseline, policies, networking, workloads, supply chain) to specify requirements and steer backlog with technical teams.
• Ability to lead multiple stakeholders and unblock decisions in complex environments, influencing without formal authority.
• Knowledge of TOGAF for designing and defining categories is desirable (useful for structuring capabilities, ABB/SBB, principles and governance).
• Familiarity and ability to work with Identity First frameworks.

Tech Stack

• Cloud
• Kubernetes
• Vault

Benefits

• Choose the benefit package that best fits you and your dependents via a digital platform with multiple categories including Gym/Wellness, Meal Voucher, Food Voucher, Pharmacy Assistance, Medical Assistance, Dental and Life Insurance;
• Corporate mobile phone. Yes, a brand-new smartphone for you!
• Unlimited voice and data plan! Yes, unlimited! Vivo's 5G is up to 10 times faster!
• An exclusive Vivo offer with special discounts on landline, broadband, TV and apps;
• Eligible to receive an annual Bonus or PPR (performance-based pay);
• Plan your future with a Private Pension plan;
• Have children? You are eligible for a subsidy to help with school, daycare or babysitting expenses;
• Work in an environment that respects your personality, dress style and individuality and allows you to be authentic. #VemDeVocê
• Work remotely up to 3 days per week. #Mobility
• Flexible working hours;
• Enjoy a day off to celebrate your birthday (Day off);
• Participate in one of the largest corporate volunteering programs to help you make an impact in the world;
• Take advantage of our Educational Development Program offering partnerships with educational institutions at a discount; certifications and online courses;