Senior Security GRC Analyst: Risk, Policy & Compliance

Hammerjack Pty Ltd; Philippines; On-site; PHP 3,769,000 - 5,653,000; Full time

Job summary

DFI Retail Group in the Philippines is seeking a Senior Security GRC Analyst to strengthen governance, risk, and compliance programs. You will lead risk assessments, maintain the security register, and support audits across enterprise environments.

The role collaborates with Information Security and IT teams to protect assets and advance cybersecurity initiatives. A minimum of 5 years in security governance, risk, compliance, or audit is required.

Qualifications

• Bachelor's degree in information technology, or Computer Science or equivalent experience.
• 5+ years in security governance, risk, compliance, audit, or security assurance roles.
• Proven track record in risk assessments, risk register management, and remediation tracking.
• Knowledge of ISO/IEC 27001 (Annex A, ISMS) and NIST CSF.
• Experience supporting internal/external audits, evidence collection, and audit readiness.
• Ability to draft clear, actionable policies and procedures; translate regulatory requirements into controls.
• Ability to translate technical diagrams into risk/control language.
• Strong written communication skills.

Responsibilities

• Governance and Policy Management: own lifecycle of policies, standards and procedures.
• Maintain policy library with version control, ownership and review cadence.
• Align governance artifacts with frameworks (NIST CSF, ISO 27001, PCI DSS, GDPR).
• Risk Management: conduct risk assessments for projects, systems and vendors.
• Document risks, treatments and residual ratings; route for risk acceptance.
• Support project risk reviews and cybersecurity pre go-live reviews with owners.
• Track remediation and follow up with mitigation owners.
• Security Architecture & Data Flow Review: review architecture and data flow diagrams for projects.
• Audit and Compliance Support: coordinate audits and manage evidence collection and readiness.
• Maintain ISMS documentation and support control assessments and evidence prep.
• Map controls against ISO/IEC 27001:2022 Annex A and NIST CSF 2.0.
• Vendor Risk: assist with vendor risk assessments and evidence review.
• Prepare dashboards, reports and leadership presentations on risk and compliance status.

Skills

Security governance

Risk management

Audit readiness

Policy drafting

Regulatory translation

Written communication

Education

Bachelor's degree in information technology, or Computer Science or equivalent experience

Job description

DFI Retail Group in the Philippines is seeking a Senior Security GRC Analyst to strengthen governance, risk, and compliance programs. You will lead risk assessments, maintain the security register, and support audits across enterprise environments.

The role collaborates with Information Security and IT teams to protect assets and advance cybersecurity initiatives. A minimum of 5 years in security governance, risk, compliance, or audit is required.