Grc Analyst

MyPass Global; Compostela; On-site; PHP 600,000 - 900,000; Full time

Benefits offered by this job

Healthcare Insurance

Wellbeing policy

Paid Time Off

Job summary

MyPass Global in Cebu City, Philippines, is seeking a GRC Analyst to manage policy, risk, CAPA, and third‑party registers within our ISMS framework. You will coordinate cross‑functional reviews, maintain evidence in Drata and Jira, and support ISO 27001 audits.

This role requires meticulous documentation in Confluence and Google Workspace, plus proactive stakeholder coordination to meet deadlines and drive continual compliance improvements.

Qualifications

• Experience in GRC, risk, or compliance roles.
• Experience managing multiple compliance registers (policy, risk, CAPA).
• Experience with GRC platforms like Drata, including evidence management.
• Audit and CAPA support experience.
• Stakeholder coordination without direct authority.
• Experience using Jira for issue tracking.
• Familiarity with Confluence for SOPs.
• Strong attention to detail and problem solving.

Responsibilities

• Policy Register Management: monitor lifecycle and deadlines.
• Coordinate policy reviews and publish in Confluence and Drata.
• Maintain controlled document registers and templates.
• Support risk register reviews and evidence with stakeholders.
• Oversee Drata control readiness and raise remediation tickets.
• Manage third-party provider registers and vendor due diligence.
• Maintain CAPA register and evidence for audits.
• Support KnowBe4 training campaigns rollout.
• Conduct system access reviews and Google Workspace guidance.
• Provide project support and document SOPs.
• Support ISO 27001 audits and ISMS documentation.

Skills

GRC experience

Risk management

Compliance expertise

Stakeholder coordination

Detail oriented

Analytical thinking

Tools

Drata

Jira

Confluence

Google Workspace

QT9

Job description

GRC Analyst

Company : Mypass Global

Job Type : Full Time

Location : Cebu City, Philippines

Job Description - GRC Analyst

Who are we? MyPass Global is a multi-award-winning workforce compliance software company. Our cutting-edge technology helps companies in high-stakes industries reduce risk, save up to 70% on back-office costs, and create safer work environments through our digital workforce solutions. As we rapidly expand with offices worldwide, we are seeking the next generation of innovative MyPassers to join us in shaping the future of our industry.

Role Outcome

Responsibilities

Policy Register Management

• Monitor the policy lifecycle to ensure review deadlines are met
• Coordinate the policy review and approval process across all business areas
• Publish approved policies in Confluence and Drata
• Maintain the controlled document register, published versions, and master files
• Maintain controlled templates within the master files and Google Gallery

Risk Register Support

• Coordinate the timely review of risks within Drata
• Support the Senior Corporate Services Manager with risk assessment scheduling, expediting evidence with stakeholders, and preparing documentation for risk closure
• Monitor and report on risk review completion status

Drata Control Readiness Oversight

• Monitor and report on Drata control readiness, identifying failing or at-risk technical, operational, and people controls
• Create and manage Jira tickets for control issues requiring remediation, coordinating with control owners through to resolution
• Coordinate personnel compliance within Drata, including monitoring onboarding and offboarding status against required timeframes
• Maintain the Drata evidence register, ensuring evidence is current, complete, and mapped to the correct controls

Third-Party Provider Register Management

• Maintain the third-party provider register covering software vendors, IT service providers, and other third-party providers
• Coordinate vendor due diligence and periodic performance reviews with relevant stakeholders
• Ensure vendor contract records, renewals, and review evidence are current and accurately maintained

CAPA Register Management

• Own the CAPA register within QT9, covering corrective actions arising from ISO audits, risk treatments, and incidents
• Expedite the collection of evidence from stakeholders to support timely CAPA closure
• Prepare and present evidence for review by the Senior Corporate Services Manager prior to closure, flagging any gaps or inconsistencies identified
• Maintain CAPA reporting and manage CAPA workflows end to end
• Support the internal audit programme, providing CAPA status and evidence to the Lead Auditor and internal auditors as required

KnowBe4 Training Campaign Support

• Coordinate the rollout of new KnowBe4 training campaigns
• Monitor the validity of training modules to ensure content remains current
• Prepare and distribute KnowBe4 completion and compliance reports

System Access Reviews

• Coordinate and undertake system access reviews on a rolling schedule across managed platforms
• Support timely remediation of identified access issues with relevant stakeholders

Google Workspace Support

• Provide guidance to users on Google Workspace functionality, including templates and shared drives
• Undertake analysis of user needs for shared drives to inform structure and access decisions

Project Support

• Provide project support as required across Corporate Services initiatives, including coordination, documentation, and status reporting

Process Documentation

• Document GRC standard operating procedures in Confluence, keeping content current as processes evolve

Compliance and Audit Support

• Support external audit processes, including ISO 27001 certification and surveillance audits
• Maintain documentation, configurations, and evidence in accordance with ISMS requirements

Requirements

Core GRC and Compliance Experience

• Demonstrated experience in GRC, risk, or compliance roles within an organisation managing information security or regulatory compliance obligations
• Proven ability to manage and coordinate multiple compliance registers simultaneously, including policy, risk, and corrective action registers
• Demonstrated experience working within a GRC platform such as Drata or equivalent, including control monitoring, evidence management, and compliance reporting

Audit and CAPA Support

• Demonstrated experience supporting internal or external audit programmes, including evidence preparation and coordination
• Experience managing or coordinating corrective action or CAPA workflows through to closure

Stakeholder Coordination

• Proven ability to coordinate across multiple business areas to meet compliance deadlines without direct authority over stakeholders
• Demonstrated experience expediting evidence or actions from stakeholders and escalating appropriately where timelines are at risk

Systems and Tooling

• Experience using Jira or equivalent ticketing tools for issue tracking and remediation coordination
• Working knowledge of Google Workspace, including shared drive structure and administration (highly desirable)
• Experience documenting standard operating procedures in a platform such as Confluence

Personal Attributes

• Demonstrated critical thinking and independent problem-solving in past roles, with evidence of identifying and resolving issues without being directed to do so
• High attention to detail, particularly in reviewing and preparing compliance evidence

Information Security Accountabilities

• Understand own contribution to the effectiveness of the ISMS
• Understand own responsibilities within the ISMS (e.g. Acceptable Use of Assets Policy, Information Security Policy)
• Understand the consequences of non-compliance with the requirements of the ISMS
• Understand information security guidelines related to own job role

Life at MyPass

• Accessible and friendly office in Cebu IT Park
• Celebrate You - Anniversary gifts as early as your first work anniversary!
• Be Healthy - Wellbeing policy with a strong focus on whatever makes you feel good from the inside out, and a company-sponsored Healthcare Insurance worth PHP 110, 000.00 .
• Work-Life Balance - Enjoy the right to disconnect with our 16 Paid Time Offs and 8 Compensatory Time Offs!
• Fuel Your Growth Journey - Unlocking your potential with a blend of in-person and online learning and development opportunities
• Get Rewarded and Recognized - Your impact to the business is seen and recognized through our Monthly Value Awards
• Be Comfortable - Casual Friday every day!
• We Love to Have Fun - Team outings, weekly lunches, team events, the list goes on…
• Generous Employee Referral Program - Rewards for referring top talent

Feel valuable We’re big on culture. So much so that the team we've carefully curated are not only high-performers, they're also excellent humans. We foster an environment that is open, respectful and collaborative, where the status quo is challenged and both success and failure are celebrated. MyPass champions diversity at all levels of the company, and we live by our core values that set us apart. We cultivate an inclusive culture and do not discriminate based on race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We are dedicated to creating a workplace where everyone feels valued, respected, and empowered to bring their authentic selves to work. Our mantra is to make things happen, every single day.

We cultivate an inclusive culture and do not discriminate based on race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Our company values

• Bring out the best - We connect and empower people to build a safer future. We strive to create a positive and enduring impact, no matter how small.
• Challenge the norm - We pursue innovation by practising curiosity and always asking ‘why’. We challenge assumptions by seeking opportunities for growth and improvement.
• Treat people well - We treat our customers, employees and partners as equals. We foster meaningful relationships through trust, compassion and respect.
• Walk the walk - We are accountable for our goals, actions and collective vision. We work with integrity and are true to our word.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.