Senior Security GRC Analyst: Policy, Risk & Compliance

DFI Technology (Philippines); Mandaluyong; Vor Ort; PHP 900.000 - 1.800.000; Vollzeit

Zusammenfassung

DFI Retail Group is seeking a Senior Security GRC Analyst in Metro Manila to lead governance, risk, and compliance programs. You will own policy lifecycle, run risk assessments, support audits, and ensure alignment with ISO 27001 and NIST CSF.

You will collaborate with Information Security and IT teams to protect assets, strengthen security posture, and drive cybersecurity initiatives across enterprise environments. A strong track record in risk management and audit readiness is essential.

Qualifikationen

• Bachelor’s degree in information technology, or Computer Science or equivalent experience.
• 5+ years in security governance, risk, compliance, audit, or security assurance roles.
• Proven track record in risk assessments, risk register management, and remediation tracking.
• Working knowledge of ISO/IEC 27001 (Annex A, ISMS docs) and NIST CSF.
• Experience in supporting internal/external audits, evidence collection, and audit readiness activities.
• Strong ability to draft clear, actionable policies and procedures; translate regulatory requirements into control procedures.
• Ability to translate technical diagrams into risk/control language.

Aufgaben

• Governance and Policy Management: Own the lifecycle of security policies, standards and procedures; draft, review, update and track approvals and exceptions.
• Maintain the policy library with version control, ownership, and review cadence.
• Align governance artifacts with frameworks (NIST CSF, ISO 27001, PCI DSS, GDPR as applicable).
• Conduct risk assessments for projects, systems, and vendors using DFI's methodology.
• Document risks, treatments, and residual ratings; route for risk acceptance per authority tiers.
• Support project security risk assessment reviews and cybersecurity pre go-live security reviews with system/application owners.
• Track remediation and follow up with mitigation control/remediation action owners.
• Security Architecture & Data Flow Review: Review security architecture diagrams and data flow diagrams for new projects, system changes, and vendor integrations.
• Validate designs against DFI security standards, segmentation principles, and data classification requirements.
• Audit and Compliance Support: Coordinate annual security audits and certifications (ISO 27001,PCI DSS); manage evidence collection, stakeholder coordination and audit readiness.
• Support control self-assessments and audit evidence preparation
• Map controls/findings against ISO/IEC 27001:2022 Annex A and NIST CSF 2.0
• Third-Party & Vendor Risk: Assist with vendor security risk assessments (documentation/evidence review)
• Maintain security risk assessment records and chase outstanding vendor evidence
• General Security GRC Support: Update Security GRC templates, trackers, and reporting materials
• Support ad hoc governance, audit, and compliance tasks
• Prepare dashboards, reports, and presentations for leadership on risk, compliance, audit and awareness program status.

Kenntnisse

Security governance

Risk assessment

Audit support

Policy drafting

Regulatory knowledge

Ausbildung

Bachelor's degree in IT/CS

Jobbeschreibung

DFI Retail Group is seeking a Senior Security GRC Analyst in Metro Manila to lead governance, risk, and compliance programs. You will own policy lifecycle, run risk assessments, support audits, and ensure alignment with ISO 27001 and NIST CSF.

You will collaborate with Information Security and IT teams to protect assets, strengthen security posture, and drive cybersecurity initiatives across enterprise environments. A strong track record in risk management and audit readiness is essential.