Regional Cybersecurity Manager — Risk & CoE Lead

Company 81 - Manulife Data Services Inc.; Manila; Hybrid; PHP 1,200,000 - 1,800,000; Full time

Job summary

Manulife Financial Corporation (MFC) seeks a Cybersecurity Manager within the BUSO Center of Excellence (CoE) under Asia CISO. The role drives end-to-end risk assessments, security controls, and governance across Asia markets, coordinating with BUSOs and stakeholders to improve information security and regulatory compliance.

You will lead assessments, translate findings into actionable mitigations, and support incident response and risk management, while promoting standardized processes and

Qualifications

• University/College graduate with 3–5 years of progressive Cybersecurity experience, including 3+ years as an Information Security Officer.
• Solid background in Cybersecurity Management, Information Security Risk Assessment (both in project and BAU), Security Incident Response and Coordination, Access Review, Data Loss Prevention Management and other security processes like incident/crisis management, access management, vulnerability and patch management, as well as operational processes for business continuity and disaster recovery.
• Profound knowledge and understanding of Manulife’s Information Risk Management Framework (Risk Identification and Assessment, Risk Treatment, Risk Monitoring, Sustain and Independent Review), CIA Triad (Confidentiality, Integrity and Availability), Zero-Trust Tolerance.
• Expert in the following technologies: JIRA, ServiceNow, Devo, PowerBI, Confluence, Archer.
• Certifications: CISSP, CISM preferred; GCIH or incident response certifications advantageous.
• Strong knowledge of technology trends and financial services/insurance environments.
• Self‑driven, organized, and able to meet objectives with minimal supervision.
• Ability to break down complex issues into simple, actionable insights.
• A collaborative team player who partners effectively with control functions to support timely project delivery.
• Committed to continuous learning, improvement, and embracing change.
• Strong problem‑solving capabilities, especially in fast‑paced or ambiguous situations.
• Effective in managing escalations and regulatory interactions under pressure.
• Excellent verbal and written communication skills, with the ability to explain technical concepts clearly.

Responsibilities

• Lead and perform end-to-end Project Information Risk Assessments across Asia markets, from initial scoping and information criticality assessment through risk identification, control evaluation, risk treatment, remediation tracking, and business risk acceptance.
• Review assessments completed by market or designated assessors to ensure the consistent application of risk methodologies, control requirements, documentation standards, and quality expectations.
• Analyze project designs, architectures, data flows, technology components, third-party arrangements, and applicable security requirements to identify information security and operational risks.
• Translate assessment findings into clear risk statements and practical recommendations; advise project, technology, and business stakeholders on appropriate mitigation strategies and compensating controls.
• Monitor risk-treatment plans, commitments, exceptions, and risk acceptances; maintain assessment schedules and records, follow up on overdue actions, and elevate material or unresolved risks through appropriate governance channels.
• Develop and maintain the regional information risk assessment framework, including playbooks, templates, procedures, training materials, quality assurance plans, standardized reporting, performance measures, and mechanisms for sharing best practices.
• Promote the information risk assessment program across Asia markets and provide guidance to market BUSOs, assessors, project teams, and other stakeholders to strengthen risk ownership and assessment quality.
• Provide application and information security consultation to project teams, technology partners, and business stakeholders, including facilitating specialized security assessments when required.
• Partner with market BUSOs and relevant control functions to identify operational security and risk-management activities suitable for centralization, standardization, automation, or transition to the CoE.
• Establish and maintain effective governance for CoE services, including service scope, roles and responsibilities, onboarding and offboarding procedures, reporting, service measures, issue management, and escalation paths.
• Deliver assigned centralized security and operational risk activities consistently and within agreed service expectations, including analysis of high-risk service requests and support for other BAU control processes.
• Support the end-to-end management and timely resolution of security incidents, particularly Data Loss Prevention incidents, in coordination with market BUSOs and relevant response teams.
• Provide regular status, risk, and performance updates to market BUSOs and regional stakeholders, highlighting key findings, trends, overdue actions, emerging risks, and matters requiring decision or escalation.
• Conduct knowledge transfer, coaching, and knowledge-sharing sessions for new team members, market assessors, and IT control and governance teams.
• Contribute to continuous improvement initiatives that enhance the effectiveness, efficiency, scalability, and consistency of regional security and risk-management processes.

Skills

Cybersecurity management

Information security risk assessment

Security incident response

Access review

Data Loss Prevention

Incident management

Vulnerability management

Patch management

Disaster recovery

Education

Bachelor's degree in a relevant field

Tools

JIRA

ServiceNow

Devo

PowerBI

Confluence

Archer

Job description

Manulife Financial Corporation (MFC) seeks a Cybersecurity Manager within the BUSO Center of Excellence (CoE) under Asia CISO. The role drives end-to-end risk assessments, security controls, and governance across Asia markets, coordinating with BUSOs and stakeholders to improve information security and regulatory compliance.

You will lead assessments, translate findings into actionable mitigations, and support incident response and risk management, while promoting standardized processes and