Information Security Specialist

Pioneer Insurance; Taguig; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

Pioneer Insurance in the Philippines seeks an Information Security professional to lead third-party risk management, vendor due diligence, and privacy controls across the supplier ecosystem. You will review contracts for security provisions, support ISMS improvements, coordinate with Legal and the DPO, and conduct risk and privacy assessments throughout the vendor lifecycle.

ISO27001/ISACA knowledge and Data Privacy Act expertise are preferred to drive audits, awareness campaigns, and ongoing

Qualifications

• Graduate of IT/IS, CPA or Computer Eng degree.
• Minimum 3 years in information security and data privacy.
• ISMS ISO27001 knowledge and/or certification.
• Experience in security risk assessments and privacy controls.
• Knowledge of the Data Privacy Act.

Responsibilities

• Conduct security due diligence and risk assessments for vendors, suppliers, and third-party service providers.
• Evaluate third-party security posture through questionnaires, document reviews, and security ratings.
• Review vendor compliance with information security requirements prior to onboarding.
• Monitor and manage third-party security risks throughout the vendor lifecycle and recommend remediation actions.
• Maintain the Third-Party Risk Register and security assessment documentation.
• Lead or support Privacy Impact Assessments (PIAs).
• Review contracts, DSAs, NDAs, and service agreements for information security requirements.
• Ensure security, confidentiality, incident notification, access control, and data protection provisions.
• Collaborate with Legal, Procurement, and the DPO during contract negotiations.
• Recommend security requirements for cloud, SaaS, outsourcing, and managed service arrangements.
• Develop and implement organization-wide information security awareness programs.
• Conduct phishing simulations, security campaigns, and awareness activities.
• Develop security advisories, educational materials, and role-based security training.
• Monitor and report awareness effectiveness using participation and phishing simulation metrics.
• Conduct internal information security assessments against ISO/IEC 27001 and organizational security policies.
• Assess compliance with Data Privacy Principles, including Transparency, Legitimate Purpose, and Proportionality.
• Coordinate vulnerability assessments, security reviews, and corrective action tracking.
• Validate the implementation and effectiveness of security controls across business units.
• Support internal and external audits by preparing required evidence and documenting findings.
• Recommend continuous improvements to the Information Security Management System (ISMS).

Skills

Security risk management

Data privacy

ISMS implementation

ISO 27001 knowledge

Privacy regulations

Audit support

Vendor risk assessment

Education

IT/IS degree

CPA

Computer Eng8g degree

Job description

• Conduct security due diligence and risk assessments for vendors, suppliers, and third-party service providers.
• Evaluate third-party security posture through questionnaires, document reviews, and security ratings.
• Review vendor compliance with information security requirements prior to onboarding.
• Monitor and manage third-party security risks throughout the vendor lifecycle and recommend remediation actions.
• Maintain the Third-Party Risk Register and security assessment documentation.
• Lead or support Privacy Impact Assessments (PIAs).

Security Review of Contracts and Agreements

• Review contracts, Data Sharing Agreements (DSAs), NDAs, and service agreements for information security requirements.
• Ensure appropriate security, confidentiality, incident notification, access control, and data protection provisions are included.
• Collaborate with Legal, Procurement, and the Data Protection Officer (DPO) during contract negotiations.
• Recommend security requirements for cloud, SaaS, outsourcing, and managed service arrangements.

Security Awareness and Culture

• Develop and implement organization-wide information security awareness programs.
• Conduct phishing simulations, security campaigns, and awareness activities.
• Develop security advisories, educational materials, and role-based security training.
• Monitor and report awareness effectiveness using participation and phishing simulation metrics.

Security Audits and Assessments

• Conduct internal information security assessments against ISO/IEC 27001 and organizational security policies.
• Assess compliance with Data Privacy Principles, including Transparency, Legitimate Purpose, and Proportionality.
• Coordinate vulnerability assessments, security reviews, and corrective action tracking.
• Validate the implementation and effectiveness of security controls across business units.
• Support internal and external audits by preparing required evidence and documenting findings.
• Recommend continuous improvements to the Information Security Management System (ISMS).

Qualifications:

• Graduate of a 4-years IT / IS, CPA, Computer Eng’g course. Preferably with security license/certifications (i.e., ISO, ISACA) or equivalent.
• Minimum of five (3) years of experience in the field of information security and data privacy.
• Experience in ISMS implementation and /or certification
• Knowledge in ISMS ISO27001 standards (but not limited), guiding the development of InfoSec policy/standards/controls
• Knowledge in Data Privacy Act of 2012 and other relevant privacy regulations.
• Demonstrated hands-on experience in security risk and data privacy with proven methodology and structured approach
• Experience in an ISMS ISO27001/ISO27005 risk assessment technique, implementation and quality assurance audits