Latest AI JobsBrowse Jobs
W

Technical Security Governance Lead - Exposure Management

WPPSão Paulo, BrazilLegal & Compliance
Apply on company site
Salary
Not listed
Job type
Full-time
Posted
27 Jul 2026
Status
Open · checked 7d ago

About this role

WPP is hiring a Technical Security Governance Lead – Exposure Management to build, mature, and govern a modern exposure management capability in São Paulo, Brazil. This strategic, lead-level role is ideal for a security professional eager to shape how security is measured, validated, and improved through practical attacker realism.

Role Overview

The Technical Security Governance Lead – Exposure Management helps the organization understand how attackers view internal, external, and AI-enabled environments. This position moves beyond theoretical risk into real-world attacker perspectives by governing adversarial testing programs, enhancing attack surface visibility, validating exploitability, and conducting attack path analysis. The role operates within a hybrid work model where teams collaborate in the office around four days a week.

Key Responsibilities

Define and shape the governance framework, minimum standards, and guardrails for continuous exposure management across global environments.
Drive continuous improvements in attack surface visibility, control effectiveness, and risk-driven exposure governance while establishing escalation thresholds for delayed remediations.
Oversee and govern continuous adversarial testing and offensive validation programs across infrastructure, applications, cloud, APIs, and identity.
Partner with and govern external specialist providers to validate real-world exploitability and complex attack paths.
Shape governance approaches for AI and agentic systems, overseeing testing for modern AI risks including prompt injection resilience, data leakage scenarios, tool misuse, and agent permission boundaries.
Maintain strategic visibility of external-facing assets by governing unknown asset discovery, internet exposure drift, and shadow IT.
Map and analyze intricate attack paths across identity boundaries, lateral movement pathways, privilege escalation routes, and cloud trust relationships.

Requirements

Minimum of 5 years of professional experience in offensive security, attack surface management, red teaming, or exposure management.
Strong technical comprehension of attacker tradecraft, modern attack techniques, and adversarial testing methodologies such as EASM, BAS, and Attack Path Analysis.
Proven background analyzing attack paths within identity- and cloud-based environments.
Interest or hands-on experience in AI security and emerging AI attack models.
Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

Nice to Have

Industry-recognized certifications such as CISSP, OSCP, or CREST.

Skills and Tools

Exposure Management and Attack Surface Management (EASM)
Breach and Attack Simulation (BAS) and Attack Path Analysis
Offensive security, red teaming, and vulnerability validation
AI security and agentic systems testing frameworks
Cloud and identity environment security analysis

About the Company

WPP is a leading global transformation partner for top brands, uniting data solutions, media intelligence, creativity, and strategic counsel. Powered by exceptional talent and the WPP Open platform, the company helps clients navigate change across more than 100 markets. WPP champions a culture of inclusion, continuous learning, belonging, and extraordinary collaboration.

How to Apply

Interested candidates should visit the official WPP careers page to submit an application and learn more about this hybrid opportunity in São Paulo.

Questions candidates ask

What is the primary focus of the Technical Security Governance Lead role?

The role focuses on building, maturing, and governing a modern exposure management capability, emphasizing attacker perspectives across external, internal, and AI-enabled environments.

What level of experience is required for this position?

Candidates must have at least 5 years of experience in exposure management, offensive security, red teaming, or attack surface management.

Is this a remote position?

No, this is a hybrid role based in São Paulo, Brazil, where teams typically work from the office around four days a week.

What specific AI security risks will this role help govern?

The role oversees testing for modern AI risks such as prompt injection resilience, tool misuse, data leakage scenarios, and agent permission boundaries.

Are any specific certifications preferred for applicants?

Industry certifications such as CISSP, OSCP, or CREST are highly regarded for this position.

Ready to apply?

The application is on the official WPP careers page.

Apply on company site