IT Governance and InfoSecurity Lead

SM Retail Inc.; Pasay; On-site; PHP 1,620,000 - 1,980,000; Full time

Job summary

SM Retail Inc. seeks an IT Governance Lead to shape governance, risk, compliance, and vendor management across the technology estate.

You will define policies, controls, and reporting to drive accountability and measurable business outcomes. In this senior role, you will partner with business and IT teams to oversee audit remediation, risk registers, and contract reviews, while guiding multi-vendor delivery and program governance to secure reliable, compliant technology services.

Qualifications

• Bachelor's degree in IT, CS, or Business Administration.
• 10–15+ years in IT governance, program management, or vendor management.
• Experience with multi-vendor environments and governance reporting.
• Certifications: ITIL, PMP, COBIT, ISO 27001 are a plus.

Responsibilities

• Lead IT governance policies, standards, and procedures.
• Translate governance requirements into practical operational controls.
• Establish change, release, incident, access, and data classification controls.
• Review policy exceptions, waivers, and governance issues; escalate risks when needed.
• Maintain enterprise risk registers, governance trackers, and audit remediation actions.
• Oversee governance reviews for IT programs with clear ownership and timelines.

Skills

Stakeholder management

Communication

Presentation skills

Leadership

Risk management

Education

Bachelor's degree in Information Technology / Computer Science / Business Administration

Job description

The IT Governance Lead will lead our IT governance, risk, compliance, and vendor management functions. This is a strategic leadership role responsible for establishing governance frameworks, strengthening operational controls, managing technology risks, and ensuring that IT initiatives are delivered with accountability and measurable business outcomes.

What You'll Do

Lead IT Governance

• Develop, implement, and continuously improve IT governance policies, standards, and procedure
• Translate governance requirements into practical operational controls that promote compliance and consistency
• Establish standards for change management, release management, incident management, access management, and data classification
• Review policy exceptions, waivers, and governance issues, and escalated critical risks when necessary

Drive Risk, Security & Compliance

• Maintain enterprise RAID logs, risk registers, and governance trackers
• Monitor audit findings, cybersecurity remediation actions, and regulatory obligations through closure.
• Partner with the Information Security team on VAPT activities, remediation tracking, and security governance initiatives

Strengthen Program & Delivery Governance

• Oversee governance reviews for IT programs and projects to ensure clear ownership, realistic timelines, and measurable success criteria
• Establish RACI structures, acceptance criteria, and definitions of done for major initiatives
• Identify delivery risks, unresolved blockers, and aging action items, and drive timely escalation and resolution

What We're Looking For

• Bachelor's degree in Information Technology, Computer Science, Business Administration, or a related field
• At least 10-15+ years of experience in IT governance, IT program management, vendor management, IT operations, or technology delivery
• Proven experience managing complex multi-vendor environments and driving accountability for deliverables and business outcomes
• Strong background in risk management, audit remediation, compliance tracking, and governance reporting
• Experience reviewing contracts, SOWs, and change requests from an operational and commercial risk perspective
• Excellent stakeholder management, communication, and presentation skills
• Relevant certifications are an advantage: ITIL, PMP, COBIT, ISO 27001, or equivalent