Cyber Governance, Risk and Compliance Specialist at VBP

City of Cebu, Cebu, Philippines -

Full Time

Start Date

Immediate

Expiry Date

06 Oct, 26

Salary

0.0

Posted On

08 Jul, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Information Security Governance, Risk Management, Compliance, ISMS Maintenance, Risk Assessment, IT Audit, Third-party Due Diligence, Policy Development, Governance Reporting, ISO 27001, NIST CSF, CIS Controls, ISO 31000, Data Protection, Privacy Regulations, Incident Management

Industry

Financial Services

Description

Overview of the Role The Cyber Governance, Risk and Compliance (GRC) Specialist supports the organization's information security governance by managing security risks, maintaining the Information Security Management System (ISMS), managing & developing the Cyber awareness program, and ensuring compliance with applicable policies, standards, and regulatory requirements. The role also coordinates risk assessments, audits, governance reporting, and continuous improvement initiatives to strengthen the organization's overall security posture. Responsibilities: Support the implementation, maintenance, and continual improvement of the organization's Information Security Management System (ISMS). Develop, review, and maintain information security policies, standards, procedures, and related governance documentation. Conduct information security risk assessments, develop & maintain the Information Security Risk Register, and monitor the implementation of risk treatment plans. Coordinate internal and external information security audits, track audit findings, and ensure timely remediation of identified issues. Conduct information security due diligence and risk assessments for third-party vendors, suppliers, and service providers. Prepare and present governance reports, risk metrics, compliance dashboards, and management reports for executive leadership and governance committees. Monitor emerging cybersecurity risks, regulatory changes, and industry best practices, and recommend improvements to governance, risk management, and compliance processes. Minimum 5 years' experience in Information Security GRC, IT Risk, Information Security, IT Audit, or a related field. Bachelor's degree in Information Security, Computer Science, Information Systems, Risk Management, or a related field. Relevant professional certifications such as CISSP, CISM, CRISC, ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CGRC, or equivalent are highly desirable. Demonstrated experience in developing, implementing, maintaining, and continually improving an Information Security Management System (ISMS), preferably aligned with ISO/IEC 27001. Knowledge of security governance frameworks and standards such as ISO/IEC 27001, ISO 31000, NIST Cybersecurity Framework (CSF), CIS Controls, and applicable data protection and privacy regulations. Experience conducting information security risk assessments, facilitating risk treatment plans, and monitoring risk mitigation activities across the organization. Working knowledge of cybersecurity technologies, security operations, and incident management sufficient to assess risks, review reports, and provide governance oversight. Strong written and verbal communication skills, including the ability to prepare governance reports, policies, executive briefings, and presentations for senior management and governance committees. High level of integrity, professionalism, and commitment to confidentiality and ethical conduct. 500K per incident HMO coverage + Dental & Optical benefits 2-week paid Christmas vacation Electricity & Data subsidies 25K Educational Assistance Training and equipment will be provided Fixed Schedule of Mon-Fri from 7 AM to 4 PM

Responsibilities

The specialist manages the organization's information security governance by maintaining the ISMS and conducting risk assessments. They are also responsible for coordinating audits, managing third-party due diligence, and reporting security metrics to executive leadership.