Looking for a job

Marcelo Bastos

@marcelobastos

Senior Information Security Consultant at LOCATELLI GROUP leading ISO/IEC 27001 and 27701 certification and AI security governance.

Brazil

Message

What I'm looking for

I’m available for U.S. remote engagements as an independent contractor (B2B), with full overlap with U.S. business hours.

At LOCATELLI GROUP, I lead ISO/IEC 27001 and ISO/IEC 27701 certification programs, including remediation of more than 50 non-conformities in 2026 and authorship of 9 policies. I also support internal and client audits and advise on network, application, cloud, AI, and IoT security, embedding controls from solution design onward.

Previously, at KYNDRYL, I set security direction across client projects, deployed automated resilience controls that reduced manual verification effort by approximately 30%, and handled high- to critical-severity incidents. Across consulting work at ILUMINE NEGÓCIOS, STEFANINI GROUP, and NETSECURITY BRASIL, I delivered GRC, audit, risk, privacy, and security programs; I’m now building depth in AI agent governance, MCP Security, and automation risk.

Experience

Work history, roles, and key accomplishments

Current

Senior Information Security Consultant

Current

Locatelli Group

Feb 2026 - Present (8 months)

Leads ISO/IEC 27001 and 27701 certification programs, addressing nonconformities and authoring policies. Acts as security SME for audits and advises on network, AppSec, cloud, AI, and IoT security.

ISO 27001 ISO 27701 Security By Design AI Security MCP Security Audit Management Nonconformity Resolution

Senior Security, Risk, IoT and AI Consultant

Ilumine Negócios

Nov 2021 - Jan 2026 (4 years 2 months)

Delivered risk assessments and security architecture improvements for clients across multiple industries. Managed vulnerability and patch management, third-party risk, and incident response.

Risk Assessment Security Architecture Vulnerability Management Patch Management Third Party Risk Management Incident Response Cloud Security IoT Security AI Security

Lead Security Consultant

Kyndryl

Apr 2023 - Nov 2024 (1 year 7 months)

Provided technical leadership for security and resilience across a corporate client portfolio. Designed automated resilience controls, led incident response, and ran compliance assessments.

Security Strategy ISO 27001 NIST CSF Incident Response Compliance Assessments Automation Business Continuity Stakeholder Engagement

Information Security Consultant

Kyndryl

Nov 2021 - Apr 2023 (1 year 5 months)

Advised clients on enterprise and third-party risk management, ISO/IEC 27002 controls, and compliance programs. Delivered security awareness programs and anti-phishing campaigns.

Risk Management ISO 27002 Compliance Security Awareness Phishing Defense Vulnerability Management Offensive Security MITRE ATT&CK OWASP Burp suite Kali Linux

Information Security Consultant

Stefanini Group

Mar 2020 - Nov 2021 (1 year 8 months)

Delivered consulting and audit engagements across ISO/IEC 27001, NIST, PCI-DSS, OWASP, and LGPD/GDPR. Implemented Privacy by Design and Security by Design programs and built security awareness training.

ISO 27001 NIST PCI DSS OWASP LGPD GDPR Privacy By Design Security By Design Security Awareness Phishing Defense SASE ZTNA Cyber Resilience

Information Security Specialist

NetSecurity Brasil

Jul 2019 - Jan 2020 (6 months)

Built an Information Security Management System (ISMS) from the ground up, including risk assessment and policy development. Delivered multi-framework GRC and conducted GAP analysis and audits.

ISMS ISO 27001 ISO 27002 ISO 27005 GRC Gap Analysis Audit Security Awareness Privacy By Design Zero Trust

IT Analyst

Equifax | Boa Vista

Mar 2017 - Jul 2019 (2 years 4 months)

Sustained service availability above 98.5% against a 98% SLA target across critical applications. Consulted on information security, infrastructure, backup, and service level agreements.

Availability SLA Management Risk Management Incident Remediation Root Cause Analysis Technical Documentation team training

IT Consultant

HP - Hewlett-Packard

Aug 2008 - Oct 2014 (6 years 2 months)

Delivered international projects for global clients, covering risk analysis, defense and mitigation solutions, and disaster recovery planning. Provided infrastructure consulting and solution design.

Risk Analysis Disaster Recovery Planning Infrastructure Consulting Solution Design HPOM HP Reporter HP BAC CA Unicenter Unix Linux Windows Server

Support Analyst / Systems Administrator

EDS - Electronic Data Systems

Sep 2000 - Aug 2008 (7 years 11 months)

Worked across information security, risk analysis, identity and access management, and security policy. Administered server and infrastructure environments and delivered ITIL-based IT service management.