GRC Analyst II: Elevate IT Risk & Compliance

Vertiv; Mandaluyong; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

Vertiv in the Philippines is seeking a Governance, Risk and Compliance Analyst II to strengthen IT security program maturity across the enterprise. The role focuses on risk assessments, policy controls, and third-party risk management.

You will collaborate with global teams, drive risk mitigation actions, and prepare audit-ready evidence using tools like OneTrust and ServiceNow GRC. A 5+ year background in GRC or information security is expected.

Qualifications

• Bachelor's degree in information systems or cybersecurity and related field.
• 5+ years in GRC, IT risk, or information security.
• Experience with GRC platforms and audit-ready evidence.

Responsibilities

• Lead IT risk assessments, mitigation planning, and control monitoring.
• Oversee risk register updates and coordinate with risk owners.
• Drive third-party risk reviews using OneTrust and SecurityScorecard.
• Conduct contract reviews for information security terms.
• Respond to customer security questionnaires with SMEs input.
• Supervise compliance training rollouts (phishing campaigns, awareness).
• Review IT security policies aligned with ISO 27001 and NIST CSF.
• Generate GRC dashboards and KPIs for leadership.
• Escalate GRC inquiries and manage exceptions.
• Mentor junior analysts and develop SOPs.

Skills

GRC experience

IT risk management

Audit readiness

Stakeholder management

Documentation

Education

Bachelor’s degree in Information Systems / Cybersecurity

Tools

ServiceNow GRC

OneTrust

SecurityScorecard

Job description

Vertiv in the Philippines is seeking a Governance, Risk and Compliance Analyst II to strengthen IT security program maturity across the enterprise. The role focuses on risk assessments, policy controls, and third-party risk management.

You will collaborate with global teams, drive risk mitigation actions, and prepare audit-ready evidence using tools like OneTrust and ServiceNow GRC. A 5+ year background in GRC or information security is expected.