Cyber Security Risk Assessment Specialist

PLDT; Makati; On-site; PHP 600,000 - 900,000; Full time

Job summary

PLDT is seeking a cybersecurity risk analyst to determine the enterprise’s risk posture across systems, products, and services, ensuring alignment with internal standards and regulatory compliance.

You will perform risk assessments, identify and mitigate risks, review architectures and data flows, and drive risk treatment plans and remediation with project teams.

Qualifications

• Bachelor's Degree in IT, Computer Science, Engineering, or related field.
• 3 to 4 years of experience as an Analyst, Specialist, or related role within IT or Cybersecurity.
• Knowledge of information security, IT, telecommunications tech, audits, regulatory compliance, and risk management.

Responsibilities

• Perform risk assessments for multiple critical projects and initiatives across PLDT Group.
• Identify, assess, and mitigate security-related risks within defined risk tolerance.
• Conduct security risk assessments and validations per company standards and industry practices.
• Review project information, including scope, network architecture, and data flows, to support risk assessments.
• Analyze designs and network diagrams to identify vulnerabilities and recommend controls.
• Create and monitor risk treatment plans with timelines and residual risks.
• Track remediation of vulnerabilities and compliance requirements before deployment.
• Lead project risk assessment activities and coordinate with teams.

Skills

Information Security

Risk Assessment

Cloud Security

Regulatory Compliance

Network Architecture

Threat Intelligence

Vendor Risk

Education

Bachelor's Degree in IT/CS/Engineering

Job description

Determine the enterprise’s cybersecurity risk posture for existing systems, products, and services across the PLDT Group, ensuring alignment with internal standards and full regulatory compliance.

Responsibilities

• Perform risk assessments for multiple critical projects and initiatives involving new assets, technologies, products, and services across the PLDT Group.
• Identify, assess, and mitigate security-related risks within Executive Management's defined risk tolerance levels.
• Conduct security risk assessments and validations in accordance with company standards, processes, and industry best practices.
• Gather and review project information, including scope, network architecture, data flow diagrams, evidence, and artifacts to support cybersecurity risk assessments.
• Analyze solution designs, data flow diagrams, and network architecture diagrams to identify vulnerabilities and recommend security controls.
• Create and monitor risk treatment plans, including risk findings, mitigation controls, residual risks, and implementation timelines.
• Track implementation of risk treatments and cybersecurity compliance requirements before production deployment or launch.
• Facilitate regular checkpoint meetings with project teams and document assessment results, compliance status, and reports.
• Assess requests that deviate from cybersecurity policies and standards, including non-standard internet access, application access, local administrator rights, and VPN access requests.
• Perform vulnerability scans on project-related applications, servers, and assets.
• Track and coordinate remediation of identified vulnerabilities and produce vulnerability management reports.
• Lead project risk assessment activities, facilitate meetings, ensure timely completion of deliverables, and maintain accurate project records and documentation.

Qualifications

Education

• Bachelor's Degree in Information Technology, Computer Science, Engineering, or any related course/discipline.

Work Experience

• 3 to 4 years of experience as an Analyst, Specialist, or related role within Information Technology or Cybersecurity.

Skills & Knowledge

• Experience in Information Security, Information Technology, Telecommunications Technology, Information Systems Audit, Operational Risk, Process and Policy Development, or Regulatory Compliance.
• Knowledge of cloud service models (IaaS, PaaS, SaaS) and associated security services.
• Familiarity with security technologies and solutions.
• Understanding of common cyber threats, including DDoS, brute-force attacks, SQL injection, and malware infections.
• Knowledge of risk assessment frameworks and methodologies, cybersecurity frameworks, cybersecurity tools, technology risk, laws and regulations impacting technology-driven businesses, on-premise and cloud infrastructure, project management, and requirements analysis.

Preferred Certifications

• CISA, CISM, CRISC, Security+, CISSP, CEH, or similar industry-recognized certifications.