Governance, Risk & Compliance (GRC) Manager

Seven Seven Global Services, Inc.; Metro Manila; On-site; PHP 1,200,000 - 2,100,000; Full time

Job summary

Seven Seven Global Services, Inc. is seeking a Governance, Risk & Compliance (GRC) Manager – Information Security & Data Privacy to lead the ISMS, privacy program, and compliance activities across the organization.

You will coordinate audits, maintain policies and risk registers, and drive remediation with senior stakeholders. The role requires at least 5 years in information security governance, GRC or related fields, with demonstrated ISO/IEC 27001 expertise and strong policy and

Qualifications

• Bachelor's degree in IT, IS, cybersecurity, risk management or related field.
• At least 5 years of relevant experience in information security governance, GRC, ISMS, data privacy or IT risk/compliance.
• Proven experience with ISO/IEC 27001 implementation, maintenance, audits or certification.
• Experience managing policies, risks, audit findings and remediation activities.
• Experience engaging with auditors, clients and senior stakeholders.
• Strong knowledge of ISO/IEC 27001, GRC, risk, controls and compliance.
• Working knowledge of Philippine data privacy requirements.
• Strong policy governance, investigation and report-writing skills.
• Solid analytical and root-cause-analysis capabilities.
• Ability to translate regulatory and technical requirements into practical controls.

Responsibilities

• Maintain and improve the organization's ISMS in accordance with ISO/IEC 27001.
• Coordinate surveillance, recertification, internal and client audits.
• Maintain security policies, risk registers, control requirements, audit findings and remediation actions.
• Coordinate periodic security risk and control assessments with business and technical owners.
• Lead annual information security awareness activities.
• Lead responses to client security questionnaires, RFPs and due diligence.
• Maintain Data Privacy and Data Protection Program.
• Monitor applicable Philippine and international privacy requirements.
• Maintain integrated view of compliance obligations, risks and corrective actions.
• Coordinate investigations of information security, privacy, compliance and incidents.

Skills

ISO/IEC 27001

GRC fundamentals

Information security governance

Data privacy compliance

Risk management

Audit coordination

Policy development

Stakeholder engagement

Education

Bachelor's degree in IT / IS / Cybersecurity / Risk Mgmt / related field

Job description

About the role

The Governance, Risk & Compliance (GRC) Manager – Information Security & Data Privacy leads the organization's information security governance, data privacy, compliance, and management-system programs. The role owns the governance of the Information Security Management System (ISMS), supports continued ISO/IEC 27001 compliance, coordinates security and privacy assurance activities, and drives organization-wide policies, controls, risk management, audits, and continuous improvement. This is a cross-functional role working with Executive Management, IT, HR, Finance, Operations, Service Delivery, clients, auditors, certification bodies, and external partners.

Key responsibilities

• Maintain and continuously improve the organization's ISMS in accordance with ISO/IEC 27001

• Coordinate surveillance, recertification, internal, client, and other relevant security audits

• Maintain security policies, standards, risk registers, control requirements, exceptions, audit findings, and remediation actions

• Coordinate periodic security risk and control assessments with relevant business and technical owners

• Lead annual information security awareness activities

• Lead responses to client security questionnaires, RFP requirements, due diligence, and security assessments

• Maintain the organization's Data Privacy and Data Protection Program

• Monitor applicable Philippine and international privacy requirements relevant to the organization's operations and clients

• Maintain an integrated view of key compliance obligations, risks, audit findings, non-conformities, and corrective actions

• Coordinate investigations of information security, privacy, compliance, and significant operational incidents

About you

• Bachelor's degree in Information Technology, Information Systems, Cybersecurity, Risk Management, Business, Legal Management, Industrial Engineering, or a related field

• At least 5 years of relevant experience in Information Security Governance, GRC, ISMS, Data Privacy, IT Risk, IT Audit, or Compliance

• Demonstrated experience with ISO/IEC 27001, including implementation, maintenance, audit, or certification activities

• Experience managing policies, risks, audit findings, remediation, and compliance assessments

• Experience engaging with auditors, clients, certification bodies, and senior stakeholders

• Strong knowledge of ISO/IEC 27001, GRC, risk, controls, audit, and compliance

• Working knowledge of Philippine data privacy requirements

• Strong policy, governance, investigation, and report-writing skills

• Strong analytical and root-cause-analysis capability

• Ability to translate regulatory and technical requirements into practical business controls