Information Security Manager

Private Advertiser; Makati; On-site; PHP 2,009,000 - 2,902,000; Full time

Job summary

Private Advertiser seeks an experienced information security leader to oversee governance, risk and control assurance, security operations oversight and incident coordination. You will safeguard information, systems and services while supporting regulatory compliance and awareness initiatives.

The role partners with the Data Privacy Officer to align privacy and security frameworks, manage third‑party security, and drive critical improvements across the enterprise.

Qualifications

• Bachelor degree related to IT or business/controls with added preference
• At least 10–12 years in IT/information security including governance, risk, incident response
• Knowledge of data privacy law and NPC/PH data protection requirements generally preferred

Responsibilities

• Oversee day‑to‑day cyber security governance ensuring compliance with standards and programs
• Coordinate vulnerability management and incident response with IT ops and CISO/DPO
• Lead security awareness programs and manage third‑party security across vendor lifecycles

Skills

Security governance

Incident response

Risk management

Security awareness

Education

Bachelor's degree in IT or related

Tools

EDR

Firewall

SIEM

Job description

Under the supervision of the CISO, lead day-to-day information security governance, risk and control assurance, security operations oversight and incident coordination; safeguard the company's information, systems and services; support regulatory compliance and security awareness; and report material risks and remediation progress to the CISO.

The incumbent will work closely with the company's designated Data Privacy Officer, who is primarily responsible for the data protection framework, regulatory compliance initiatives and related matters.

JOB DESCRIPTION

Governance:

• Responsible for the day-to-day cyber security governance to ensure security compliance per all standards, agreements & programs applicable to the business.
• Responsible for developing and driving effective ISD security compliance programs involving activities such as to review and develop security policies, processes/procedures, and guidelines, establish compliance with policies, standards, conduct security risk assessment, assist in security advisory, audits and reviews.
• Maintain a security compliance/control register aligned with applicable Philippine Data Privacy Act and NPC requirements, relevant Insurance Commission requirements where applicable, contractual obligations and audit findings; coordinate with the DPO, Legal and Compliance on privacy-related matters.
• Collaborate with the CISO, Chief Risk Officer and business stakeholders for risk management, mitigation and remediation measures (including contributing to disaster recovery & business continuity plans)
• Maintain the enterprise information security risk register, assess new projects and material changes, assign risk owners, track residual risks and mitigation deadlines, and elevate overdue high-risk exposures to the CISO.
• Manage Third-Party Information Security Risk Assessment programs and ensure seamless delivery of Information Security Project requirements.
• Conduct company wide Information Security Awareness programs and activities such as but not limited to email advisories, cybersecurity campaigns, instructor lead seminars, etc.
• Measure security awareness effectiveness through completion, phishing simulations and targeted training for employees, agents, contractors and third parties.
• Manage third-party security throughout the supplier lifecycle: pre‑engagement due diligence, contractual safeguards, periodic reassessment, incident notification, data return/deletion and remediation tracking, including critical healthcare and cloud providers.
• Lead Cybersecurity Programs and Strategies such as Zero Trust implementation.
• Review security-by-design requirements for cloud, applications, APIs, digital channels and AI‑enabled services; oversee secure development, security testing and documented risk exceptions with system owners.

Operations

• Responsible for vulnerability management & collaboration with IT operations team in ensuring that critical vulnerabilities are addressed in timely manner.
• Define vulnerability remediation priorities and target timelines based on criticality and exposure; track exceptions, overdue actions and verification of closure, including independent penetration‑test findings.
• Oversee internal and outsourced SOC/MSSP monitoring, alert triage, incident severity classification, escalation, service levels and effectiveness reporting.
• Coordinate incident response from detection through containment, recovery and lessons learned; maintain tested playbooks and evidence procedures, and support the CISO/DPO/Legal in assessing breach notification obligations.
• Conduct research and continuously improve security architecture and controls based on the latest threat landscape.
• Oversee identity and access security (MFA, privileged access, least privilege, joiner/mover/leaver controls and periodic access reviews), with implementation by relevant IT and system owners.
• Collaborate and strategize with CISO in building up Security Operations Center
• Monitor cloud configurations, security logging, encryption and key/secrets management, backup protection, data‑loss prevention and secure sharing of member, health‑related and claims information, including third‑party and cross‑border processing risks.
• Assists the CISO in ensuring that the NIST Cybersecurity Framework of Identify, Protect, Detect, Respond and Recover as a methodology in carrying out day‑to‑day tasks is implemented and followed across the enterprise.
• Provide regular CISO reporting on security posture, incidents, critical vulnerabilities, access reviews, vendor risks, audit findings, control effectiveness and the prioritised improvement roadmap.
• Coordinate cyber resilience reviews, ransomware recovery exercises and testing of critical backups and disaster recovery dependencies with IT and business continuity owners.
  

QUALIFICATIONS

1. Education:

A Bachelor’s degree related to business management, information technology or Relevant non‑technology experience such as audits, business consulting, business operations and controls are given added preferential advantage.

2. Experience:

• a. At least 10–12 years of relevant IT and information security experience, including demonstrated responsibility for security governance, risk management, incident response and cross‑functional delivery; healthcare, insurance or HMO experience is advantageous.

3. Knowledge, Skills, and Abilities

• a. Experience in handling information security controls such as EDR, Firewall, Vulnerability Scanners, Cloud Security, SIEM, etc.
• b. Practical understanding of IAM/PAM, cloud and application/API security, secure SDLC, encryption/key management, security monitoring, third‑party assurance and cyber resilience.
• c. Preferably with one or more of the following certifications:
  • International Information System Security Certification Consortium (ISC)² 's Certified Information Systems Security Professional (CISSP), certifications, or
  • ISACA's Certified Information Security Manager (CISM), Certified in the Governance of Enterprise IT (CGEIT), Certified in Risks and Information Systems Controls (CRISC), Certified Information Systems Auditor (CISA)
• d. Additional preferred credentials include ISO/IEC 27001 Lead Implementer/Lead Auditor and recognised cloud security certifications; practical leadership and operational experience remain essential.
• e. Knowledge
  • Knowledge on current information security and data privacy legislation, regulations, advisories, alerts, and vulnerabilities, staying abreast on cybersecurity and data protection trends and best practices and maintaining access to current industry data to inform organizational decision‑making and operations
  • Working knowledge of the Philippine Data Privacy Act, NPC issuances and sector‑specific requirements applicable to IHC; ability to translate obligations into operational controls and audit evidence.
  • Strong background in Information Security management and data privacy driving policy, governance, and standards across the company.
  • Strong technical understanding, with a sound knowledge of security industry standards, including awareness of common information security management frameworks, such as the NIST Cybersecurity Framework, ISACA's Control Objectives for Information and Related Technology (COBIT), International Standards Organization (ISO) 2700x, PCI DSS and the IT Infrastructure Library (ITIL).
  • Strong awareness and understanding of risk and controls on IT and business processes.
• f. Competencies
  • 1) Technical Enterprise Risk Management - takes a holistic approach to risk management, working to break down silos among physical, business process and technology information security and data privacy areas and provides comprehensive technology, operations, and cybersecurity risk management solutions.
  • i. Technology Excellence - proactively expands technological knowledge on cybersecurity‑related technologies applicable to the Company’s business operations including its subsidiaries and understand emerging solutions and system integration processes; applies technological expertise in crafting ISDP policies, guidelines, parameters, and standards.
  • ii. Business Controls - has an appreciation and understanding of business risks facing the enterprise specially in relation to his information security and data privacy function. Has a track record of being able to dimension and prioritize assessed risks versus overall business objectives and capabilities.
  • iii. Strategic Mindset and Foresight - has the mindset of a business driver in setting and directing the current and future direction of the ISDP function aligned with the overall business and technology strategic objectives.
  • g. Transferable
    • i. Persuasive Influencing - uses compelling communication to persuade others (e.g., organizational executives) to listen and commit to, and act on, security‑related issues.
    • ii. Able to communicate security risks, control gaps and remediation priorities clearly to executive stakeholders and coordinate accountable owners across IT, business and external providers.
    • iii. Self‑Regulation - remains in control and calm when under pressure to identify resources and lead others when responding to and recovering from emergency situations.
    • iv. Customer‑Focus - could translate daily tasks and priorities in relation to meeting his customer requirements in a satisfactory manner.