Information Security Risk Analyst — Third-Party & IT Controls

Metropolitan Bank & Trust Company; Metro Manila; On-site; PHP 1,200,000 - 1,700,000; Full time

Job summary

Metropolitan Bank & Trust Company seeks a Security Assurance and Assessment Officer to develop and maintain the bank's third-party information security risk management framework. You will conduct risk assessments on third parties, systems, applications, and information assets, reviewing controls and recommending mitigations to protect confidentiality, integrity, and availability.

The role requires experience in IT general controls, auditing, and system security risk assessments, with strong

Qualifications

• Bachelor's degree in a relevant field.
• Experience in IT general controls, auditing, and system security risk assessments.
• Strong ability to assess and prioritize security risks.
• Ability to explain recommendations and trade-offs clearly.
• Experience in project security reviews and risk assessments.
• Updated knowledge of security best practices and emerging threats.
• Certifications such as CISA, CISM, CRISC, PCI-DSS, ISO 27001 are a plus.

Responsibilities

• Develop and implement plans for conducting information security, third-party, and system risk assessments.
• Identify critical assets, threats, and vulnerabilities, and evaluate the effectiveness of existing security controls.
• Assess and monitor the security performance of third-party vendors handling client data.
• Perform threat modeling and risk assessments for IT systems and assets.
• Evaluate the impact of process changes, system upgrades, and third-party engagements on security risks.
• Review and ensure adequate controls are in place to protect the confidentiality, integrity, and availability of information.
• Recommend and help develop information security policies and procedures based on assessment results.
• Coordinate with business units and stakeholders to gather information for risk assessments.
• Prepare and communicate risk assessment reports, including findings and recommended mitigation actions.
• Track and follow up on risk mitigation activities and maintain an updated risk register.

Skills

IT risk assessment

Security auditing

Third-party risk

Analytical skills

Security best practices

Threat modeling

Communication of risk

Project security reviews

Information security governance

Security certifications (CISA)

Security certifications (CISM)

Security certifications (CRISC)

Security certifications (PCI-DSS)

Security certifications (ISO 27001)

Education

Bachelor's degree in a relevant field

Job description

Metropolitan Bank & Trust Company seeks a Security Assurance and Assessment Officer to develop and maintain the bank's third-party information security risk management framework. You will conduct risk assessments on third parties, systems, applications, and information assets, reviewing controls and recommending mitigations to protect confidentiality, integrity, and availability.

The role requires experience in IT general controls, auditing, and system security risk assessments, with strong