Policy, Risk, and Control (PRC) Methodology Specialist 1 1

EY; Taguig; On-site; PHP 900,000 - 1,300,000; Full time

Benefits offered by this job

Continuous learning

Flexible working arrangements

Diverse and inclusive culture

Career development

Job summary

EY is seeking a Policy, Risk, and Control (PRC) Methodology Specialist to lead regional data protection control deployment in Taguig. You will translate global requirements into practical regional steps, coordinate with Information Security teams and business stakeholders, and drive remediation efforts to protect EY and client information assets.

The role requires strong risk management and communications skills, experience coordinating multiple activities, and the ability to work in a globally

Qualifications

• Demonstrated experience in Technology Risk Management, Information Security, Governance, Risk and Compliance, data protection or a related discipline.
• Degree in Computer Science, Information Security or a related discipline, or equivalent practical experience.
• Working knowledge of recognised policy and control frameworks, such as ISO or COBIT.
• Strong English language skills, including writing, presentation, interpersonal and communication capabilities.
• Experience coordinating stakeholders, tracking remediation activity and supporting the implementation of risk or control initiatives.
• Ability to work effectively in a globally distributed team and engage stakeholders across different levels of the organisation.

Responsibilities

• Support the deployment, adaptation and operational management of data protection controls across the assigned area or region.
• Translate global requirements into practical regional implementation steps that reflect local business, regulatory and operational needs.
• Coordinate with Information Security teams, technology teams, product owners and business stakeholders to support implementation and resolve delivery issues.
• Support Dataguard and related data protection activities while remaining adaptable to the broader Data Risk Controls portfolio.
• Track implementation progress, remediation actions, risk mitigation plans, dependencies and key programme milestones.
• Support the identification, assessment, escalation and resolution of data protection risks and control issues.
• Maintain clear and accurate reporting on implementation status, risks, decisions and follow-up actions for regional and global stakeholders.
• Help ensure remediation activities are executed consistently and issues are progressed to appropriate owners.
• Act as a liaison between global programme teams and regional stakeholders for control deployment and adoption.
• Serve as a regional point of contact for implementation requirements, operational questions and stakeholder follow-up.
• Support communications, education and awareness activities that improve understanding and adoption of data protection requirements.
• Build effective working relationships across geographies and organisational boundaries.

Skills

Technology risk management

Information security

Governance, risk & compliance

Data protection

Stakeholder engagement

Effective communication

Education

Degree in Computer Science or Information Security

Tools

ISO/COBIT

Job description

Policy, Risk, and Control (PRC) Methodology Specialist 1 1

Location: Taguig

Other locations: Primary Location Only

Requisition ID: 1754805

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.

Area/Regional Data Risk Controls Analyst
Today’s world is fuelled by vast amounts of information. Data is more valuable than ever before. Protecting data and information systems is central to doing business, and everyone in EY Information Security has a critical role to play. Join a global team of over 950 people who collaborate to support the business of EY by protecting EY and client information assets. Our Information Security professionals enable EY to work securely and deliver secure products and services, as well as detect and quickly respond to security events as they happen. Together, the efforts of our dedicated team help protect the EY brand and build client trust.
Within Information Security we blend risk strategy, digital identity, cyber defence, application security and technology solutions as we consider the entire security lifecycle. You will join a team of hardworking, security-focused individuals dedicated to supporting, protecting and enabling the business through innovative, secure solutions that provide speed to market and business value.
The opportunity
The Area/Regional Data Risk Controls Analyst will support the implementation and adoption of EY’s data protection strategy within an assigned geographic area or region. The role will help deploy and operationalise data protection controls, including controls that mitigate data exfiltration risk, while ensuring regional business requirements, regulatory considerations and operational realities are appropriately addressed.
Working with Information Security, technology teams and business stakeholders, the analyst will help translate global requirements into practical regional implementation, track progress and remediation, coordinate stakeholder activity and support the consistent adoption of data protection controls.

Your key responsibilities

Control deployment and regional implementation

• Support the deployment, adaptation and operational management of data protection controls across the assigned area or region.
• Translate global requirements into practical regional implementation steps that reflect local business, regulatory and operational needs.
• Coordinate with Information Security teams, technology teams, product owners and business stakeholders to support implementation and resolve delivery issues.
• Support Dataguard and related data protection activities while remaining adaptable to the broader Data Risk Controls portfolio.

Risk management, remediation and reporting

• Track implementation progress, remediation actions, risk mitigation plans, dependencies and key programme milestones.
• Support the identification, assessment, escalation and resolution of data protection risks and control issues.
• Maintain clear and accurate reporting on implementation status, risks, decisions and follow-up actions for regional and global stakeholders.
• Help ensure remediation activities are executed consistently and issues are progressed to appropriate owners.

Stakeholder coordination and adoption

• Act as a liaison between global programme teams and regional stakeholders for control deployment and adoption.
• Serve as a regional point of contact for implementation requirements, operational questions and stakeholder follow-up.
• Support communications, education and awareness activities that improve understanding and adoption of data protection requirements.
• Build effective working relationships across geographies and organisational boundaries.

Skills and attributes for success

• Practical understanding of technology risk, information security, data protection and internal controls.
• Ability to coordinate multiple activities, manage dependencies and meet deadlines in a fast-paced and changing environment.
• Strong written communication, presentation and stakeholder engagement skills.
• Demonstrated collaboration, negotiation and influencing skills.
• Ability to connect technical controls, business requirements and risk outcomes in clear, practical language.
• Strong attention to detail in tracking actions, reporting status and maintaining supporting information.

To qualify for the role you must have

• Demonstrated experience in Technology Risk Management, Information Security, Governance, Risk and Compliance, data protection or a related discipline.
• A degree in Computer Science, Information Security or a related discipline, or equivalent practical experience.
• Working knowledge of recognised policy and control frameworks, such as ISO or COBIT.
• Strong English language skills, including writing, presentation, interpersonal and communication capabilities.
• Experience coordinating stakeholders, tracking remediation activity and supporting the implementation of risk or control initiatives.
• Ability to work effectively in a globally distributed team and engage stakeholders across different levels of the organisation.

Ideally, you’ll also have

• A relevant certification, such as CRISC, CISM, CISA or CISSP, or progress towards an equivalent qualification.
• Experience supporting data protection, data loss prevention, control deployment or technology risk remediation initiatives.
• Awareness of external risk trends, data protection requirements and business standards.
• An understanding of EY business and Service Line risk priorities.

We seek a highly organised and collaborative professional who can coordinate security and risk activities, engage stakeholders and support consistent execution across a region. The ideal candidate combines sound judgement, strong programme coordination and communication skills, and practical experience in technology risk or information security. The person will be comfortable translating global requirements into measurable regional actions and following those actions through to completion.

What we offer

• Continuous learning: You will develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We will provide the tools and flexibility, so you can make a significant impact, your way.
• Transformative leadership: We will give you the insights, coaching and confidence to be the leader the world needs.
• Diverse and inclusive culture: You will be accepted for who you are and empowered to use your voice to help others find theirs.

We ensure that individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions and to receive other benefits and privileges of employment. Please contact us to request accommodations.

EY is committed to being an inclusive employer, and we are happy to consider flexible working arrangements. We strive to achieve the right balance for our people, enabling us to deliver excellent client service while allowing you to build your career without sacrificing your personal priorities. While our client-facing professionals can be required to travel regularly, and at times be based at client sites, our flexible working arrangements can help you to achieve a lifestyle balance.

EY | Building a better working world

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.

Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.