Mid-Level Security Governance Analyst

Indra Group; Philippines; On-site; PHP 600,000 - 900,000; Full time

Job summary

Indra Group is seeking a Mid-Level Security Governance Analyst in the Philippines for an on-site role. You will design cybersecurity learning content, lead ISMS certification activities, and develop security policies and procedures.

The role emphasizes auditing, third-party risk management, and regulatory compliance, requiring 3–5 years of experience and strong analytical abilities. The role requires strong communication skills for engaging with stakeholders and delivering training to promote

Qualifications

• Bachelor's degree in a relevant field.
• Three to five years of relevant professional experience.
• Strong knowledge of security governance frameworks, ISO 27001, NIST CSF, COBIT, and CIS Controls.
• Excellent communication skills, with the ability to create and deliver clear cybersecurity awareness content and training.
• Ability to analyze contracts and assess cybersecurity risk implications.
• Proficiency in developing, reviewing, and implementing information security policies, standards, and procedures.
• Strong analytical and problem-solving skills, particularly in compliance gap analysis and audit findings remediation.
• Ability to engage and collaborate effectively with stakeholders across business units, IT teams, and senior leadership.

Responsibilities

• Design and deliver cybersecurity awareness content and training to promote user adoption of new capabilities.
• Lead ISMS certification activities and ensure alignment with global frameworks.
• Develop and release Information Security Policies, Standards, Guidelines, and Procedures.
• Conduct Information Security Compliance Audits and monitor compliance metrics.
• Assess security posture of third parties and manage related risks.
• Support incident response exercises and compliance management activities.

Education

Bachelor's degree in a relevant field

Job description

Select how often (in days) to receive an alert:

Mid-Level Security Governance Analyst

Location: Philippines, 00, PH

Profile: Cybersecurity

Required experience:

Working mode: On-site

Role: T II

Roles and Responsibilities1. Awareness, Training, and Adoption

• Design visual and written cybersecurity learning content.
• Implement cybersecurity user awareness campaigns, learning programs, and communications to promote user adoption of new capabilities.
• Develop and deliver cybersecurity awareness materials and training to help protect the organization and its clients from cyberattacks, data breaches, reputational damage, and financial losses.

2. Compliance, Policies, Standards, and Processes

• Lead the preparation, execution, and completion of Information Security Management System (ISMS) certification activities.
• Develop, review, calibrate, and release Information Security Policies, Standards, Guidelines, and Procedures.
• Align company policies, standards, and processes with global cybersecurity frameworks.
• Conduct Information Security Compliance Audits across business and technology groups.
• Support regulatory compliance activities and the implementation of group-wide information security compliance programs.
• Perform periodic and project-specific User Access Reviews.
• Prepare compliance reports and support the monitoring of compliance metrics.

3. Third-Party Cybersecurity Risk ManagementA. Third-Party Contract Management

• Build and maintain an inventory of third parties and assess their criticality to company operations.
• Review third-party contracts to ensure that the organization's cybersecurity requirements are appropriately incorporated.
• Review contract terms and conditions to support cyber risk management, including risks arising from subcontracting.
• Collect and analyze cybersecurity risk metrics and indicators to support ongoing monitoring.

B. Third-Party Cyber Risk Management

• Assess the security posture of third parties as part of engagement renewal or extension requirements.
• Monitor changes in third-party criticality and risk, and review third-party performance on an ongoing basis to manage cybersecurity risks.
• Monitor and assess sources of third-party cyber risk for potential systemic risks.
• Implement appropriate measures to manage third-party risks and improve information sharing.
• Support the execution of Incident Response Plan (IRP) exercises and simulations involving organizational entities, third parties, and relevant partners.

5. Compliance Management Support

• Respond to cybersecurity questionnaires related to insurance applications and other external assessment requirements to establish or benchmark the organization's security risk posture.
• Assist in preparing memorandums for internal stakeholders, including asset owners, process owners, and custodians, to ensure compliance with deadlines committed to auditors.

Qualifications and Requirements

• Bachelor's degree in a relevant field.
• Three to five years of relevant professional experience.
• Strong knowledge of security governance frameworks, particularly ISO 27001, NIST Cybersecurity Framework (NIST CSF), COBIT, and CIS Controls.
• Excellent communication skills, with the ability to create and deliver clear, engaging cybersecurity awareness content and training.
• Ability to analyze contracts and assess cybersecurity risk implications.
• Proficiency in developing, reviewing, and implementing information security policies, standards, and procedures.
• Strong analytical and problem-solving skills, particularly in compliance gap analysis and audit findings remediation.
• Ability to engage and collaborate effectively with stakeholders across business units, IT teams, and senior leadership.