IT Risk Officer

Payments Network of the Philippines (formerly BancNet, Inc.); Makati; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

Payments Network of the Philippines (formerly BancNet, Inc.) is seeking an experienced IT/IS Risk Manager to advance its risk management program in a regulated financial services environment.

You will lead IT/IS risk assessments, develop risk controls, and prepare reports for senior management, governance bodies, and regulators, coordinating with IT, Compliance, Risk, Audit, and Operations to embed risk ownership across PNPI.

Qualifications

• Bachelor’s degree in IT, Cybersecurity, Risk Management, or related discipline.
• Minimum of 5 years of experience in IT Risk Management, Information Security Risk, IT Audit, Technology Risk, Cybersecurity Risk, or related IT governance/risk domains.
• Proven experience applying IT risk management frameworks, methodologies, controls, and industry best practices.
• Strong analytical and problem-solving skills with good attention to detail and communication abilities.

Responsibilities

• Supports development, implementation and execution of PNPI’s IT/IS risk program.
• Conducts IT/IS risk assessments covering systems, projects, technology initiatives, and related operational risks.
• Develops risk policies, procedures, controls, and action plans aligned with the Enterprise Risk Management Framework.
• Recommends risk mitigation strategies and monitors remediation plans.
• Monitors IT KRIs, cybersecurity threats, vulnerabilities, and related action plans.
• Prepares IT/IS risk reports and communicates findings to senior management and governance bodies.
• Coordinates with IT, Information Security, Operations, Compliance, Risk, Audit and other stakeholders on risk matters.

Skills

IT Risk Management

Information Security Risk

IT Audit

Technology Risk

Regulatory Compliance

Stakeholder Management

Education

Bachelor’s degree in IT/Cybersecurity/Risk Management/Accountancy

Job description

• Supports the development, implementation, and execution of PNPI’s IT and Information Security Risk Management Program.
• Conducts IT/IS risk assessments covering systems, projects, technology initiatives, and related operational risks, and develops corresponding risk profiles.
• Assists in developing and maintaining IT/IS risk policies, procedures, controls, and action plans aligned with the organization’s Enterprise Risk Management Framework.
• Recommends appropriate risk mitigation strategies and monitors implementation of agreed risk treatment and remediation plans.
• Monitors IT Key Risk Indicators (KRIs), emerging technology risks, cybersecurity threats, vulnerabilities, and related action plans.
• Supports compliance with applicable regulatory requirements, industry standards, internal policies, and IT/IS risk management practices.
• Coordinates with IT, Information Security, Operations, Compliance, Risk, Audit, and other internal stakeholders on risk-related matters.
• Supports regulatory and audit requirements and coordinates with regulators, auditors, vendors, participants, and member banks as needed.
• Prepares IT/IS risk reports and communicates risk assessments, findings, and recommendations to relevant stakeholders, including senior management and governance bodies.
• Supports risk awareness initiatives and promotes a strong culture of risk ownership and accountability across the organization.

QUALIFICATIONS

• Bachelor’s degree in Information Technology, Cybersecurity, Risk Management, Accountancy, or a related discipline.
• Minimum of 5 years of relevant experience in any of the following: IT Risk Management, Information Security Risk, IT Audit, Technology Risk, Cybersecurity Risk, or related IT governance or risk domains.
• Proven experience applying IT risk management frameworks, methodologies, controls, and industry best practices.
• Strong experience conducting IT/IS risk assessments and identifying, evaluating, and monitoring technology-related risks.
• Experience developing or implementing risk mitigation plans, controls, policies, procedures, or risk treatment actions.
• Good understanding of IT governance, information security, cybersecurity risks, operational resilience, and regulatory compliance.
• Strong analytical and problem-solving skills with good attention to detail.
• Strong written and verbal communication skills, including the ability to present risk findings and recommendations to management and other stakeholders.
• Strong stakeholder management and cross-functional coordination skills.

HIGHLY PREFERRED

• Experience working in a bank, financial institution, payment network, fintech, e-wallet, payment processor, or other regulated financial-services environment.
• Knowledge of the payments ecosystem, including settlement operations, technology risks, information security risks, and regulatory requirements.
• Experience coordinating with regulators, auditors, or external assurance parties on IT/IS risk matters.
• Exposure to IT/IS Key Risk Indicators (KRIs), risk and control mapping, remediation monitoring, and regulatory/audit findings.

Data Collection and Privacy Statement

In accordance with the Data Privacy Act of 2012, submission of your application constitutes your consent to the collection, use, processing, storage and endorsement of your personal information to clients, prospective employers or partner organizations solely for recruitment, evaluation, placement and other legitimate employment-related purposes.

All personal data obtained shall be treated with strict confidentiality and safeguarded through appropriate organizational, physical and technical security measures. Access to such information shall be limited to authorized personnel directly involved in the recruitment and client endorsement process and shall not be disclosed to unauthorized parties, except as may be required by law.

By submitting your application, you further represent that all information provided is true and accurate and authorize the retention of your application records for current and future employment opportunities, unless otherwise requested in writing.