IT auditor with 10+ years across Big Four (PwC) and three publicly listed fintechs (Nubank, MercadoLibre, StoneCo), specialized in IT general and application controls (ITGC/ITAC), SOX/ICFR, SDLC governance and cloud security (AWS, GCP). In my own time I build open-source tools that apply data and AI to audit work.
Based in Bragança Paulista, SP, Brazil (UTC-3).
The projects below are personal projects built on my own time. They are not affiliated with, sponsored by or endorsed by any current or past employer.
- GRC Audit Swarm — Three-phase, human-gated audit automation platform built with CrewAI. Features human approval gates between phases (modeled on engagement supervision, IIA Global Internal Audit Standards 12.3, formerly 2340), live read-only AWS evidence collection, a SHA-256-hashed evidence vault with deterministic quote matching, and schema-validated OSCAL 1.2.1 Assessment Results export.
- SCF Auto-Crosswalker — Suggests Secure Controls Framework (SCF) control IDs for IT policies, cloud findings and audit scopes, for human review, and checks a control list against frameworks such as SOC 2 per requirement (gap analysis, no language model). CSV and OSCAL export.
- Audit & GRC: IT general and application controls (ITGC/ITAC), SOX/ICFR, coordination and consolidation of SOX 404 internal-controls testing across multinational component teams (PwC), SOX 404 component audit including system-implementation controls testing before, during and after go-live (PwC), COSO, COBIT, ITIL, PCAOB and IIA standards, third-party risk management (TPRM) audits, SOC 1 and SOC 2 attestation (preparer and reviewer), SOC 2 and ISAE report review, ISO 27001, NIST CSF, PCI DSS, Secure Controls Framework (SCF) for control mapping and audit planning, Banco Central do Brasil rules for payment institutions (Res. BCB 85), LGPD/GDPR, BCP/DR
- Audit tools: Perinity GRC, ServiceNow GRC, in-house Jira-based audit management; SAP and Oracle audit programs; reporting with Google and AWS tools and Power BI
- Cloud & security: AWS, GCP, IAM, SDLC/DevSecOps, vulnerability management
- Automation & data: SQL, Python (Pandas), Scala, Databricks, BigQuery, CrewAI, LangGraph, Docker, GitHub Actions