Cybersecurity Manager

Company 81 - Manulife Data Services Inc.; Manila; Hybrid; PHP 1,200,000 - 1,800,000; Full time

Job summary

Manulife Financial Corporation (MFC) seeks a Cybersecurity Manager within the BUSO Center of Excellence (CoE) under Asia CISO. The role drives end-to-end risk assessments, security controls, and governance across Asia markets, coordinating with BUSOs and stakeholders to improve information security and regulatory compliance.

You will lead assessments, translate findings into actionable mitigations, and support incident response and risk management, while promoting standardized processes and

Qualifications

• University/College graduate with 3–5 years of progressive Cybersecurity experience, including 3+ years as an Information Security Officer.
• Solid background in Cybersecurity Management, Information Security Risk Assessment (both in project and BAU), Security Incident Response and Coordination, Access Review, Data Loss Prevention Management and other security processes like incident/crisis management, access management, vulnerability and patch management, as well as operational processes for business continuity and disaster recovery.
• Profound knowledge and understanding of Manulife’s Information Risk Management Framework (Risk Identification and Assessment, Risk Treatment, Risk Monitoring, Sustain and Independent Review), CIA Triad (Confidentiality, Integrity and Availability), Zero-Trust Tolerance.
• Expert in the following technologies: JIRA, ServiceNow, Devo, PowerBI, Confluence, Archer.
• Certifications: CISSP, CISM preferred; GCIH or incident response certifications advantageous.
• Strong knowledge of technology trends and financial services/insurance environments.
• Self‑driven, organized, and able to meet objectives with minimal supervision.
• Ability to break down complex issues into simple, actionable insights.
• A collaborative team player who partners effectively with control functions to support timely project delivery.
• Committed to continuous learning, improvement, and embracing change.
• Strong problem‑solving capabilities, especially in fast‑paced or ambiguous situations.
• Effective in managing escalations and regulatory interactions under pressure.
• Excellent verbal and written communication skills, with the ability to explain technical concepts clearly.

Responsibilities

• Lead and perform end-to-end Project Information Risk Assessments across Asia markets, from initial scoping and information criticality assessment through risk identification, control evaluation, risk treatment, remediation tracking, and business risk acceptance.
• Review assessments completed by market or designated assessors to ensure the consistent application of risk methodologies, control requirements, documentation standards, and quality expectations.
• Analyze project designs, architectures, data flows, technology components, third-party arrangements, and applicable security requirements to identify information security and operational risks.
• Translate assessment findings into clear risk statements and practical recommendations; advise project, technology, and business stakeholders on appropriate mitigation strategies and compensating controls.
• Monitor risk-treatment plans, commitments, exceptions, and risk acceptances; maintain assessment schedules and records, follow up on overdue actions, and elevate material or unresolved risks through appropriate governance channels.
• Develop and maintain the regional information risk assessment framework, including playbooks, templates, procedures, training materials, quality assurance plans, standardized reporting, performance measures, and mechanisms for sharing best practices.
• Promote the information risk assessment program across Asia markets and provide guidance to market BUSOs, assessors, project teams, and other stakeholders to strengthen risk ownership and assessment quality.
• Provide application and information security consultation to project teams, technology partners, and business stakeholders, including facilitating specialized security assessments when required.
• Partner with market BUSOs and relevant control functions to identify operational security and risk-management activities suitable for centralization, standardization, automation, or transition to the CoE.
• Establish and maintain effective governance for CoE services, including service scope, roles and responsibilities, onboarding and offboarding procedures, reporting, service measures, issue management, and escalation paths.
• Deliver assigned centralized security and operational risk activities consistently and within agreed service expectations, including analysis of high-risk service requests and support for other BAU control processes.
• Support the end-to-end management and timely resolution of security incidents, particularly Data Loss Prevention incidents, in coordination with market BUSOs and relevant response teams.
• Provide regular status, risk, and performance updates to market BUSOs and regional stakeholders, highlighting key findings, trends, overdue actions, emerging risks, and matters requiring decision or escalation.
• Conduct knowledge transfer, coaching, and knowledge-sharing sessions for new team members, market assessors, and IT control and governance teams.
• Contribute to continuous improvement initiatives that enhance the effectiveness, efficiency, scalability, and consistency of regional security and risk-management processes.

Skills

Cybersecurity management

Information security risk assessment

Security incident response

Access review

Data Loss Prevention

Incident management

Vulnerability management

Patch management

Disaster recovery

Education

Bachelor's degree in a relevant field

Tools

JIRA

ServiceNow

Devo

PowerBI

Confluence

Archer

Job description

We are seeking a Cybersecurity Manager to join Manulife Financial Corporation (MFC) under the Asia CISO organization. This role reports directly to the Asia Regional Office Security Officer and will serve as a Cybersecurity Manager within the BUSO Center of Excellence (BUSO CoE). The BUSO CoE, operating under the Asia CISO division, is dedicated to supporting Market Business Unit Security Officers (BUSOs) with specialized cybersecurity and technology control activities. The team partners closely with regional leaders and in-country BUSOs to deliver core control execution, process improvements, and project-driven initiatives. This includes reviewing high-risk service requests, handling cyber incident per global process and regulatory expectations, conducting information security risk assessments, and executing, automating, and operationalizing foundational security processes.

Position Responsibilities

Lead and perform end-to-end Project Information Risk Assessments across Asia markets, from initial scoping and information criticality assessment through risk identification, control evaluation, risk treatment, remediation tracking, and business risk acceptance. Review assessments completed by market or designated assessors to ensure the consistent application of risk methodologies, control requirements, documentation standards, and quality expectations. Analyze project designs, architectures, data flows, technology components, third-party arrangements, and applicable security requirements to identify information security and operational risks. Translate assessment findings into clear risk statements and practical recommendations; advise project, technology, and business stakeholders on appropriate mitigation strategies and compensating controls. Monitor risk-treatment plans, commitments, exceptions, and risk acceptances; maintain assessment schedules and records, follow up on overdue actions, and elevate material or unresolved risks through appropriate governance channels. Develop and maintain the regional information risk assessment framework, including playbooks, templates, procedures, training materials, quality assurance plans, standardized reporting, performance measures, and mechanisms for sharing best practices. Promote the information risk assessment program across Asia markets and provide guidance to market BUSOs, assessors, project teams, and other stakeholders to strengthen risk ownership and assessment quality. Provide application and information security consultation to project teams, technology partners, and business stakeholders, including facilitating specialized security assessments when required. Partner with market BUSOs and relevant control functions to identify operational security and risk-management activities suitable for centralization, standardization, automation, or transition to the CoE. Establish and maintain effective governance for CoE services, including service scope, roles and responsibilities, onboarding and offboarding procedures, reporting, service measures, issue management, and escalation paths. Deliver assigned centralized security and operational risk activities consistently and within agreed service expectations, including analysis of high-risk service requests and support for other BAU control processes. Support the end-to-end management and timely resolution of security incidents, particularly Data Loss Prevention incidents, in coordination with market BUSOs and relevant response teams. Provide regular status, risk, and performance updates to market BUSOs and regional stakeholders, highlighting key findings, trends, overdue actions, emerging risks, and matters requiring decision or escalation. Conduct knowledge transfer, coaching, and knowledge-sharing sessions for new team members, market assessors, and IT control and governance teams. Contribute to continuous improvement initiatives that enhance the effectiveness, efficiency, scalability, and consistency of regional security and risk-management processes.

Required Qualifications

• University/College graduate with 3–5 years of progressive Cybersecurity experience, including 3+ years as an Information Security Officer.
• Solid background in Cybersecurity Management, Information Security Risk Assessment (both in project and BAU), Security Incident Response and Coordination, Access Review, Data Loss Prevention Management and other security processes like incident/crisis management, access management, vulnerability and patch management, as well as operational processes for business continuity and disaster recovery.
• Profound knowledge and understanding of Manulife’s Information Risk Management Framework (Risk Identification and Assessment, Risk Treatment, Risk Monitoring, Sustain and Independent Review), CIA Triad (Confidentiality, Integrity and Availability), Zero-Trust Tolerance.
• Expert in the following technologies: JIRA, ServiceNow, Devo, PowerBI, Confluence, Archer.
• Certifications: CISSP, CISM preferred; GCIH or incident response certifications advantageous.
• Strong knowledge of technology trends and financial services/insurance environments.
• Self‑driven, organized, and able to meet objectives with minimal supervision.
• Ability to break down complex issues into simple, actionable insights.
• A collaborative team player who partners effectively with control functions to support timely project delivery.
• Committed to continuous learning, improvement, and embracing change.
• Strong problem‑solving capabilities, especially in fast‑paced or ambiguous situations.
• Effective in managing escalations and regulatory interactions under pressure.
• Excellent verbal and written communication skills, with the ability to explain technical concepts clearly.

Preferred Qualifications

• Professional certification in information security, technology risk, audit, or governance, such as CISM, CISSP, CRISC, CISA, or an equivalent credential.
• Experience in the financial services or insurance industry, including familiarity with regulatory, privacy, and operational resilience expectations.
• Knowledge of recognized security and governance frameworks, such as ISO/IEC 27001, the NIST Cybersecurity Framework, COBIT, or equivalent standards.
• Experience supporting regional or multi-market security programs, a Center of Excellence, or a shared-services operating model.
• Demonstrated experience standardizing, centralizing, automating, or improving information security and risk-management processes.
• Working knowledge of relevant workflow, governance, monitoring, reporting, and collaboration platforms, such as ServiceNow, Jira, Power BI, ProcessUnity, Confluence, Archer, Devo, or BlueCat Address Manager.
• Experience facilitating security assessments, consulting on application security risks, or coordinating remediation across technology and business teams.

When you join our team

We’ll empower you to learn and grow the career you want. We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words. As part of our global team, we’ll support you in shaping the future you want to see.

About Manulife and John Hancock

Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html.

Manulife is an Equal Opportunity Employer

Manulife is an Equal Opportunity Employer

At Manulife/John Hancock, we embrace our diversity.

We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals.

We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy‑related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.

It is our priority to remove barriers to provide equal access to employment.

A Human Resources representative will work with applicants who request a reasonable accommodation during the application process.

All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies.

To request a reasonable accommodation in the application process, contact [e-mail].

Working Arrangement Hybrid

We’re Manulife. And we’re on a mission to make decisions easier and lives better. Better is what drives us. It’s what inspires us to find new ways to support customers and colleagues in living longer and healthier lives. It’s the reason we’re dedicated to investing in digital innovation and industry‑leading AI, and accelerating a sustainable and economically inclusive future. Joining us means you’ll be empowered to learn and grow your career. We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words. And as part of our global team, you’ll help shape the future you want to see – and discover that better can take you anywhere you want to go. We’re proud of our accomplishments and recognition.

Amenable to work

Amenable to work in UP Ayala Technohub (Quezon City)

Amenable to work in a hybrid set-up (3x onsite per week)

Amenable to work in a day shift schedule