Risk Assessment Information Security Specialist

PLDT; Philippines; On-site; PHP 600,000 - 1,200,000; Full time

Job summary

PLDT is seeking a cybersecurity risk analyst to determine and improve the enterprise risk posture for systems, products, and services across the PLDT Group. You will conduct risk assessments, identify threats, and coordinate remediation to ensure regulatory compliance and alignment with internal standards.

The role requires 3–4 years of experience in Information Technology or cybersecurity, with familiarity in cloud security, regulatory frameworks, and risk management practices.

Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Engineering or related field.
• 3–4 years of experience in information technology or cybersecurity roles.
• Experience with risk assessments, regulatory compliance, and security controls.

Responsibilities

• Determine cybersecurity risk posture for PLDT Group systems, products and services.
• Perform risk assessments for assets, technologies, products and services.
• Identify, assess and mitigate risks within defined risk tolerances.
• Lead vulnerability assessments and coordinate remediation activities.
• Create risk treatment plans with timelines and owners.
• Track compliance requirements before deployment and during projects.
• Facilitate checkpoint meetings and document results and reports.

Skills

Information Security

Cybersecurity Risk Assessment

Cloud Security

Regulatory Compliance

Vulnerability Management

Project Management

Threat Awareness

Security Frameworks

Education

Bachelor's Degree in IT/CS/Engineering

Tools

Vulnerability Scanning Tools

Risk Management Tools

Cloud Security Tools

Job description

Determine the enterprise’s cybersecurity risk posture for existing systems, products, and services across the PLDT Group, ensuring alignment with internal standards and full regulatory compliance.

Responsibilities

• Perform risk assessments for multiple critical projects and initiatives involving new assets, technologies, products, and services across the PLDT Group.
• Identify, assess, and mitigate security-related risks within Executive Management's defined risk tolerance levels.
• Conduct security risk assessments and validations in accordance with company standards, processes, and industry best practices.
• Gather and review project information, including scope, network architecture, data flow diagrams, evidence, and artifacts to support cybersecurity risk assessments.
• Analyze solution designs, data flow diagrams, and network architecture diagrams to identify vulnerabilities and recommend security controls.
• Create and monitor risk treatment plans, including risk findings, mitigation controls, residual risks, and implementation timelines.
• Track implementation of risk treatments and cybersecurity compliance requirements before production deployment or launch.
• Facilitate regular checkpoint meetings with project teams and document assessment results, compliance status, and reports.
• Assess requests that deviate from cybersecurity policies and standards, including non-standard internet access, application access, local administrator rights, and VPN access requests.
• Perform vulnerability scans on project-related applications, servers, and assets.
• Track and coordinate remediation of identified vulnerabilities and produce vulnerability management reports.
• Lead project risk assessment activities, facilitate meetings, ensure timely completion of deliverables, and maintain accurate project records and documentation.

Qualifications

Education

• Bachelor's Degree in Information Technology, Computer Science, Engineering, or any related course/discipline.

Work Experience

• 3 to 4 years of experience as an Analyst, Specialist, or related role within Information Technology or Cybersecurity.

Skills & Knowledge

• Experience in Information Security, Information Technology, Telecommunications Technology, Information Systems Audit, Operational Risk, Process and Policy Development, or Regulatory Compliance.
• Knowledge of cloud service models (IaaS, PaaS, SaaS) and associated security services.
• Familiarity with security technologies and solutions.
• Understanding of common cyber threats, including DDoS, brute-force attacks, SQL injection, and malware infections.
• Knowledge of risk assessment frameworks and methodologies, cybersecurity frameworks, cybersecurity tools, technology risk, laws and regulations impacting technology-driven businesses, on-premise and cloud infrastructure, project management, and requirements analysis.

Preferred Certifications

• CISA, CISM, CRISC, Security+, CISSP, CEH, or similar industry-recognized certifications.