Senior Security GRC Lead: Policy, Risk & Compliance

DFI Technology (Philippines); Mandaluyong; On-site; PHP 1,200,000 - 1,900,000; Full time

Job summary

DFI Retail Group seeks a Senior Security GRC Analyst to lead governance, risk, and compliance initiatives across enterprise environments. The role focuses on risk assessments, maintaining the security register, audit support, and alignment with ISO 27001 and NIST CSF, with vendor risk oversight.

You will collaborate with Information Security and IT teams to strengthen security posture, drive remediation, and ensure controls are in place for regulatory and contractual requirements across the

Qualifications

• Bachelor’s degree in information technology, computer science, or equivalent experience.
• 5+ years in security governance, risk, compliance, audit, or assurance roles.
• Experience with risk assessments, risk registers and remediation tracking.
• Working knowledge of ISO/IEC 27001 and NIST CSF; audits & evidence collection.

Responsibilities

• Govern governance and policy management; draft, review and track approvals.
• Maintain policy library with version control and review cadence.
• Align artifacts with frameworks (NIST CSF, ISO 27001, PCI DSS, GDPR).
• Conduct risk assessments for projects, systems and vendors; document risks and treatments.
• Support audits; coordinate evidence collection and audit readiness.
• Map controls to ISO/IEC 27001:2022 Annex A and NIST CSF 2.0.
• Assist with vendor security risk assessments and evidence review.
• Prepare dashboards and reports for leadership on risk, compliance, and audits.

Skills

Security governance

Risk management

Compliance

Audit

Policy drafting

Risk assessment

Vendor risk

Education

Bachelor's degree in IT or Computer Science

Tools

ISO 27001

NIST CSF

PCI DSS

GDPR

Job description

DFI Retail Group seeks a Senior Security GRC Analyst to lead governance, risk, and compliance initiatives across enterprise environments. The role focuses on risk assessments, maintaining the security register, audit support, and alignment with ISO 27001 and NIST CSF, with vendor risk oversight.

You will collaborate with Information Security and IT teams to strengthen security posture, drive remediation, and ensure controls are in place for regulatory and contractual requirements across the