Information Security and Data Protection Specialist

SYCiP SECROU HERNANDEZ & GATMAITAN; Philippines; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

SYCiP SECROU HERNANDEZ & GATMAITAN is seeking an Information Security Manager to establish and maintain security policies, coordinate programs, and ensure regulatory compliance, including DPA 2012. The role requires at least 3 years of security leadership experience and a CISSP preference.

The successful candidate will work with IT, HR and legal teams to train staff, review supplier SLAs, and oversee internal audits to strengthen the firm’s information security posture.

Qualifications

• Minimum 3 years of experience in information security management.
• CISSP certification is preferred.
• Graduate of Computer Science, Computer Engineering, Information Technology, or related field.

Responsibilities

• Establish, document, and maintain information security policies, processes, and procedures.
• Coordinate information security programs across teams and with suppliers.
• Coordinate review of SLAs related to information security.
• Coordinate with process owners to identify and update security assets and risks.
• Lead information security awareness and training programs with IT and HR.
• Conduct annual information security internal audits.
• Investigate incidents and monitor corrective actions.
• Respond to audit questionnaires and risk assessments.
• Monitor compliance with the Data Privacy Act (DPA) 2012.
• Act as DPA liaison and point person.

Skills

Information security management

Policy development

Risk assessment

Incident investigation

Training & awareness

Audit coordination

Education

Bachelor's degree in Computer Science/Engineering/Information Technology

CISSP certification preferred

Job description

Responsibilities:

1. Handle the establishment, documentation, communication and maintenance of information security policies, processes and procedures, including a business continuity and disaster recovery plan.
   • Create and update policies and procedures in all information security systems related documents.
   • Coordinate with all teams to ensure the implementation of information security programs.
   • Coordinate the review of service level agreements of all suppliers / providers relating to information security.
   • Coordinate with business process owners in identifying and updating of information security assets and risks.
   • Facilitate the information security training and awareness programs and campaigns in coordination with IT and HR departments.
   • Conduct information security internal audit at least once a year.
   • Investigate and evaluate incident reports and monitor the effectiveness of corrective actions.
2. Respond to audit questionnaires, risk assessments and other client assessments on information security.
3. Monitor the firm's compliance with the Data Privacy Act (DPA) of 2012.
4. Design and implement programs/policies/activities to ensure compliance to the law (in coordination with lawyers handling DPA).
5. Act as the firm's point person on matters relating to the DPA.

Requirements:

• Graduate of Computer Science, Computer Engineering, Information Technology, or a related field; Certified Information Systems Security Professional (CISSP) certification is preferred.
• With at least 3 years of relevant experience in information security management and/or the implementation and management of business continuity and disaster recovery programs.