Information Security Specialist

PLDT; Makati; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

PLDT is seeking a cybersecurity risk professional to determine and strengthen the enterprise risk posture across the PLDT Group, ensuring alignment with internal standards and regulatory compliance. You will lead risk assessments, validate controls, and coordinate remediation for vulnerabilities in projects, networks, and cloud services.

Strong knowledge of risk frameworks and security governance is required.

Qualifications

• Bachelor's degree in IT, CS, engineering or related field.
• 4-5 years of IT or cybersecurity experience.
• Knowledge of cloud security and regulatory requirements.

Responsibilities

• Perform risk assessments for multiple critical projects across the PLDT Group.
• Identify and mitigate security risks within defined risk tolerances.
• Conduct risk assessments and validations per company standards and best practices.
• Review project scope, network architecture, data flow, evidence to support assessments.
• Analyze designs and diagrams to identify vulnerabilities and recommend controls.
• Lead risk treatment plans, track remediation, and ensure timely deployment.
• Coordinate with project teams and document assessment results and reports.
• Assess requests deviating from cybersecurity policies, including access and VPN requests.
• Perform vulnerability scans and track remediation.

Skills

Risk assessment

Information security

Cloud security

Security frameworks

Regulatory compliance

Project management

Education

Bachelor's degree in IT/CS/Engineering

Tools

Vulnerability scanners

Job description

Determine the enterprise’s cybersecurity risk posture for existing systems, products, and services across the PLDT Group, ensuring alignment with internal standards and full regulatory compliance.

Responsibilities

• Perform risk assessments for multiple critical projects and initiatives involving new assets, technologies, products, and services across the PLDT Group.
• Identify, assess, and mitigate security-related risks within Executive Management's defined risk tolerance levels.
• Conduct security risk assessments and validations in accordance with company standards, processes, and industry best practices.
• Gather and review project information, including scope, network architecture, data flow diagrams, evidence, and artifacts to support cybersecurity risk assessments.
• Analyze solution designs, data flow diagrams, and network architecture diagrams to identify vulnerabilities and recommend security controls.
• Create and monitor risk treatment plans, including risk findings, mitigation controls, residual risks, and implementation timelines.
• Track implementation of risk treatments and cybersecurity compliance requirements before production deployment or launch.
• Facilitate regular checkpoint meetings with project teams and document assessment results, compliance status, and reports.
• Assess requests that deviate from cybersecurity policies and standards, including non-standard internet access, application access, local administrator rights, and VPN access requests.
• Perform vulnerability scans on project-related applications, servers, and assets.
• Track and coordinate remediation of identified vulnerabilities and produce vulnerability management reports.
• Lead project risk assessment activities, facilitate meetings, ensure timely completion of deliverables, and maintain accurate project records and documentation.

Qualifications

Education

• Bachelor's Degree in Information Technology, Computer Science, Engineering, or any related course/discipline.

Work Experience

• 4-5 years of experience as an Analyst, Specialist, or related role within Information Technology or Cybersecurity.

Skills & Knowledge

• Experience in Information Security, Information Technology, Telecommunications Technology, Information Systems Audit, Operational Risk, Process and Policy Development, or Regulatory Compliance.
• Knowledge of cloud service models (IaaS, PaaS, SaaS) and associated security services.
• Familiarity with security technologies and solutions.
• Understanding of common cyber threats, including DDoS, brute-force attacks, SQL injection, and malware infections.
• Knowledge of risk assessment frameworks and methodologies, cybersecurity frameworks, cybersecurity tools, technology risk, laws and regulations impacting technology-driven businesses, on-premise and cloud infrastructure, project management, and requirements analysis.

Preferred Certifications

• CISA, CISM, CRISC, Security+, CISSP, CEH, or similar industry-recognized certifications.