Information Security Risk Analyst

Metropolitan Bank & Trust Company; Metro Manila; On-site; PHP 1,200,000 - 1,700,000; Full time

Job summary

Metropolitan Bank & Trust Company seeks a Security Assurance and Assessment Officer to develop and maintain the bank's third-party information security risk management framework. You will conduct risk assessments on third parties, systems, applications, and information assets, reviewing controls and recommending mitigations to protect confidentiality, integrity, and availability.

The role requires experience in IT general controls, auditing, and system security risk assessments, with strong

Qualifications

• Bachelor's degree in a relevant field.
• Experience in IT general controls, auditing, and system security risk assessments.
• Strong ability to assess and prioritize security risks.
• Ability to explain recommendations and trade-offs clearly.
• Experience in project security reviews and risk assessments.
• Updated knowledge of security best practices and emerging threats.
• Certifications such as CISA, CISM, CRISC, PCI-DSS, ISO 27001 are a plus.

Responsibilities

• Develop and implement plans for conducting information security, third-party, and system risk assessments.
• Identify critical assets, threats, and vulnerabilities, and evaluate the effectiveness of existing security controls.
• Assess and monitor the security performance of third-party vendors handling client data.
• Perform threat modeling and risk assessments for IT systems and assets.
• Evaluate the impact of process changes, system upgrades, and third-party engagements on security risks.
• Review and ensure adequate controls are in place to protect the confidentiality, integrity, and availability of information.
• Recommend and help develop information security policies and procedures based on assessment results.
• Coordinate with business units and stakeholders to gather information for risk assessments.
• Prepare and communicate risk assessment reports, including findings and recommended mitigation actions.
• Track and follow up on risk mitigation activities and maintain an updated risk register.

Skills

IT risk assessment

Security auditing

Third-party risk

Analytical skills

Security best practices

Threat modeling

Communication of risk

Project security reviews

Information security governance

Security certifications (CISA)

Security certifications (CISM)

Security certifications (CRISC)

Security certifications (PCI-DSS)

Security certifications (ISO 27001)

Education

Bachelor's degree in a relevant field

Job description

About the role

The Security Assurance and Assessment Officer is responsible for developing and maintaining the bank's third-party information security risk management framework, ensuring it aligns with the overall enterprise risk strategy. This role conducts security risk assessments on third parties, systems, applications, and information assets. It reviews processes, systems, and network security controls to identify potential risks and recommend appropriate mitigation strategies. The officer also evaluates the security of production environments and provides recommendations to protect the confidentiality, integrity, and availability of the bank's information, systems, and services.

Key responsibilities

• Develop and implement plans for conducting information security, third-party, and system risk assessments.
• Identify critical assets, threats, and vulnerabilities, and evaluate the effectiveness of existing security controls.
• Assess and monitor the security performance of third-party vendors handling client data.
• Perform threat modeling and risk assessments for IT systems and assets.
• Evaluate the impact of process changes, system upgrades, and third-party engagements on security risks.
• Review and ensure adequate controls are in place to protect the confidentiality, integrity, and availability of information.
• Recommend and help develop information security policies and procedures based on assessment results.
• Coordinate with business units and stakeholders to gather information for risk assessments.
• Prepare and communicate risk assessment reports, including findings and recommended mitigation actions.
• Track and follow up on risk mitigation activities and maintain an updated risk register.

About you

• Bachelor's degree in a relevant field
• Experience in IT general controls, auditing, and system security risk assessments
• Strong understanding of risk assessment and the ability to evaluate and prioritize security risks
• Able to analyze business risks and clearly explain recommendations and trade-offs
• Experience in project security reviews and risk assessments
• Strong analytical skills with the ability to identify risks and recommend appropriate actions
• Updated knowledge of security best practices and emerging threats
• Relevant certifications (e.g., CISA, CISM, CRISC, PCI-DSS, ISO 27001) are a plus

About us

At Metrobank, we don't simply hire employees—we hone future leaders. We provide opportunities that enhance your skills and unlock your talents, helping you evolve into a well-rounded individual. We supply you with all the pieces you need to do your best work, unleashing your full potential to help you secure your future and lead a fulfilling career. With Metrobank's strong heart for the community, you have the chance to give back and make worthwhile contributions to our nation's economic and social development.