Information Security Compliance Specialist

Avvoka; Manila; Vor Ort; PHP 800.000 - 1.200.000; Vollzeit

Zusammenfassung

Avvoka is seeking an Information Security Compliance Specialist to help maintain our ISMS and ensure ISO 27001 certification health. You will respond to customer security questionnaires, assess supplier risk, and manage security documentation with guidance from the Information Security Manager.

You’ll collaborate with Engineering, DevOps, Sales, Legal, and People Ops to keep security controls robust and transparent for clients and partners.

Qualifikationen

• 2-3 years in information security compliance, GRC, IT audit or a similar role.
• Experience completing customer security questionnaires for a SaaS or technology business.
• Experience assessing third-party or supplier security risk.
• Enough technical understanding of cloud hosting, access control, encryption, AI integrations, and secure development to discuss them credibly with engineers and customers.
• Clear, precise writing; able to turn technical controls into plain answers and policies.

Aufgaben

• Run the ISMS: maintain the ISMS day-to-day, support SOC 2 Type II work, manage risk registers and risk treatments.
• Answer customer security questionnaires with guidance from the Information Security Manager and maintain an approved answer library.
• Assess supplier security: due diligence on new vendors, maintain supplier inventory, track remediation actions.
• Manage security documentation: keep documentation library updated, map docs to customer commitments.

Kenntnisse

InfoSec compliance

GRC

IT audit

Customer questionnaires

Third-party risk

Cloud security

Technical writing

Tools

ISO 27001

SOC 2 Type II

Cyber Essentials Plus

Jobbeschreibung

About This Job

We build legal drafting technology for moments that matter - when the stakes are high, the documents are complex, and speed can’t come at the cost of control.

About This Job

We build legal drafting technology for moments that matter - when the stakes are high, the documents are complex, and speed can’t come at the cost of control.

Our platform helps legal teams move faster through contracts using automation, collaboration, and AI - without taking judgment away from the lawyers who own the risk. We believe technology should amplify expertise, not replace it.

Avvoka is trusted by leading law firms, banks, and global enterprises, and we’ve grown through product strength and word of mouth alone. With headcount and revenue increasing by over 70% year on year, we’re scaling from a product-led success into a globally recognised legal-tech brand.

We’re at an inflection point: evolving how the world’s most sophisticated legal teams work - and building a company where thoughtful people can do the best work of their careers.

The role

You will keep Avvoka’s ISO 27001 certification healthy and help our clients trust us with their most sensitive documents. Avvoka’s customers are law firms and legal teams, so security assurance is part of every sale and every renewal.

This is a hands-on compliance role. You will help run the day-to-day of our Information Security Management System (ISMS), answer customer security due diligence questionnaires, assess the security of our suppliers, and manage our security documentation, with guidance from the Information Security Manager. You will work closely with Engineering, DevOps, Sales, Customer Success, Legal, and People Operations teams.

What You’ll Do

Run the ISMS

• Help the team to maintain the ISMS day-to-day in line with ISO/IEC 27001, including the control evidence, and support SOC 2 Type II work where applicable.
• Support the internal audit programme and surveillance and recertification audits with the certification body.
• Maintain the information security risk register, facilitate risk assessments and follow up on treatment plans.
• Support security awareness training, track completion, and contribute to the company’s security awareness programme.

Answer customer security questionnaires

• Manage the response process for customer and prospect security questionnaires, with guidance from the Information Security Manager.
• Maintain an approved answer library so responses are fast, consistent, and accurate.

Assess supplier security

• Assist the team to run security due diligence on new suppliers and sub-processors before onboarding, scaled to the data and access they hold.
• Maintain the supplier inventory with risk tiers, owners, contract dates, and review cycles.
• Carry out periodic security reassessments of existing vendors.
• Track supplier remediation actions and keep the public sub-processor list current.

Manage security documentation

• Assist the team in maintaining the security documentation library, keeping documents version-controlled, approved, and reviewed at least annually.
• Draft and update policies, standards and procedures as the business, technology and regulations change.
• Map documentation to customer contractual commitments so gaps are visible.

What You’ll Bring

• 2-3 years in information security compliance, GRC, IT audit or a similar role.
• Experience completing customer security questionnaires for a SaaS or technology business.
• Experience assessing third-party or supplier security risk.
• Enough technical understanding of cloud hosting, access control, encryption, AI integrations, and secure development to discuss them credibly with engineers and customers.
• Clear, precise writing; able to turn technical controls into plain answers and policies.

Bonus Points If You Have

• Certifications such as CISA or ISO 27001 Lead Implementer.
• Experience with SOC 2 Type II or Cyber Essentials Plus.
• An understanding of secure AI governance.

Equal opportunities

We are an equal opportunity employer that celebrates diversity and inclusion. We welcome applications from individuals of all backgrounds, identities, and experiences - including those from underrepresented groups - and are happy to provide reasonable adjustments for candidates with disabilities during the recruitment process.