Cyber Security Manager

Bloomberry Resorts and Hotels Inc.; Naga; On-site; PHP 1,800,000 - 3,000,000; Full time

Job summary

Bloomberry Resorts and Hotels Inc. is seeking a senior security leader to develop and execute the organization’s cyber security strategy across online gaming and corporate environments. You will lead security operations, manage vulnerabilities, and drive compliance with PAGCOR, privacy, and industry standards.

You will mentor teams, coordinate with IT and DevOps, and continuously optimize security controls and awareness programs to protect critical assets and data.

Responsibilities

• Develop, implement, and maintain the cyber security strategy, policies, and standards for the online gaming platform and corporate environments.
• Lead security operations including threat monitoring, detection, incident response, and forensic investigations.
• Manage the vulnerability management program: scanning, penetration testing, and remediation tracking across applications and infrastructure.
• Oversee security architecture reviews for new systems, platform integrations, and third-party service providers, including PAGCOR-mandated integrations.
• Operate and optimize security technologies such as SIEM, EDR, WAF, IDS/IPS, and DLP; evaluate new tools as threats evolve.
• Ensure compliance with regulatory and industry requirements including PAGCOR, the Data Privacy Act, PCI DSS, and ISO 27001; support audits and certifications.
• Design and deliver security awareness programs to strengthen the organization’s security culture.
• Lead, mentor, and develop the security engineering and operations team, managing performance and development.
• Coordinate with GRC, IAM, network, server, and DevOps teams to embed security controls across systems and processes.
• Manage third-party security providers, including SOC, penetration testing, and threat intelligence vendors, against defined SLAs.
• Maintain and regularly test the incident response plan and supporting playbooks, including tabletop and simulated exercises.
• Report security posture, key risks, and incident metrics to senior management and recommend risk treatment actions.

Job description

• Develop, implement,and maintain the cyber security strategy, policies, and standards coveringthe online gaming platform and corporate environments.
  
• Lead securityoperations, including threat monitoring, detection, incident response, andforensic investigation, ensuring incidents are contained and resolved withinagreed timelines.
  
• Manage thevulnerability management program, including scanning, penetration testing,and remediation tracking across applications and infrastructure.
  
• Oversee securityarchitecture reviews for new systems, platform integrations, and third-partyservice providers, including PAGCOR-mandated integrations.
  
• Operate andoptimize security technologies such as SIEM, EDR, WAF, IDS/IPS, and DLP,evaluating new tools as the threat landscape evolves.
  
• Ensure compliancewith regulatory and industry requirements, including PAGCOR, the Data PrivacyAct, PCI DSS, and ISO 27001, supporting audits and certification activities.
  
• Design and deliversecurity awareness programs to strengthen the organization's securityculture.
  
• Lead, mentor, anddevelop the security engineering and operations team, managing performanceand capability development.
  
• Coordinate withGRC, IAM, network, server, and DevOps teams to embed security controls acrosssystems and processes.
  
• Manage third-partysecurity providers, including SOC, penetration testing, and threatintelligence vendors, against defined SLAs.
  
• Maintain andregularly test the incident response plan and supporting playbooks, includingtabletop and simulation exercises.
  
• Report security posture, key risks, and incidentmetrics to senior management and recommend risk treatment actions.
  

Key Performance Indicators/Key Success Factors

• Mean time to detect and mean time torespond to security incidents.
  
• Percentage of critical and highvulnerabilities remediated within SLA.
  
• Closure rate of audit and compliancefindings within committed dates.
  
• Security awareness training completion rateand phishing simulation results.
  
• Availability and coverage of securitymonitoring tools across critical systems.