Senior Specialist, GRC

LaVie; Manila; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

LaVie seeks a Sr. Specialist GRC to align IT systems, controls and policies with regulatory requirements and internal standards. You will collaborate with IT, Security, Engineering, and Audit teams to manage technology risks and support compliance initiatives.

You will develop IT policies, perform risk assessments, and coordinate audits, with emphasis on ISO frameworks, SOC2, PCI DSS, and HIPAA rules. Strong communication and documentation skills are essential.

Qualifications

• Bachelor's degree in Information Systems, Risk Management, Business, Law, or a related field.
• 2+ years of experience in GRC, risk management, compliance, audit, or information security.
• Strong understanding of IT controls, cybersecurity principles, and system architecture.
• Experience with audits and regulatory examinations.
• Experience with cloud platforms and SaaS environments preferred.
• Excellent analytical, documentation, and communication skills.
• Experience in a regulated industry (PCI DSS, DPA, SOC2, etc.).
• Risk assessment and control design.
• Regulatory and compliance analysis.
• Audit coordination and remediation management
• Policy development and governance
• Stakeholder communication and influence

Responsibilities

• Develop and maintain IT policies, standards, and procedures
• Support governance frameworks (e.g., ISO 27001, COBIT, NIST CSF, COSO)
• Ensure alignment between business objectives, IT strategy, and security controls
• Conduct IT and information security risk assessments
• Evaluate technical controls across infrastructure, cloud, applications, and data
• Support vulnerability management and control remediation tracking
• Perform third-party IT and cybersecurity risk assessments
• Support compliance with IT-focused regulations and standards (e.g., SOC2, ISO 27001, PCI DSS, SOX ITGCs, HIPAA Security Rules)
• Coordinate IT audits and penetration testing activities
• Collect, review, and maintain technical audit evidence
• Monitor regulatory changes and assess business impact
• Track remediation efforts and continuous improvement initiatives
• Partner with IT Infrastructure, CyberSecurity, Technical/Application Support and DevOps teams
• Prepare IT risk metrics, dashboards, and compliance reports
• Support security awareness and control training initiatives

Skills

GRC

Risk management

Regulatory compliance

IT controls

Audit coordination

Regulatory analysis

Cloud platforms

Communication

Documentation

Education

Bachelor's degree in Information Systems

Tools

Cloud platforms

Job description

Job Brief

The Sr. Specialist GRC focuses on technology, cybersecurity, and information risk. This role ensures IT systems, infrastructure, and security controls align with regulatory requirements, industry standards, and internal policies. The specialist works closely with IT, Security, Engineering, and Audit teams to manage technology risks and support compliance initiatives.

Job Responsibilities

• Develop and maintain IT policies, standards, and procedures
• Support governance frameworks (e.g., ISO 27001, COBIT, NIST CSF, COSO)
• Ensure alignment between business objectives, IT strategy, and security controls
• Conduct IT and information security risk assessments
• Evaluate technical controls across infrastructure, cloud, applications, and data
• Support vulnerability management and control remediation tracking
• Perform third-party IT and cybersecurity risk assessments
• Support compliance with IT-focused regulations and standards (e.g., SOC2, ISO 27001, PCI DSS, SOX ITGCs, HIPAA Security Rules)
• Coordinate IT audits and penetration testing activities
• Collect, review, and maintain technical audit evidence
• Monitor regulatory changes and assess business impact
• Track remediation efforts and continuous improvement initiatives
• Partner with IT Infrastructure, CyberSecurity, Technical/Application Support and DevOps teams
• Prepare IT risk metrics, dashboards, and compliance reports
• Support security awareness and control training initiatives

Job Qualifications

• Bachelor's degree in Information Systems, Risk Management, Business, Law, or a related field
• 2+ years of experience in GRC, risk management, compliance, audit, or information security
• Strong understanding of IT controls, cybersecurity principles, and system architecture
• Experience with audits and regulatory examinations
• Experience with cloud platforms and SaaS environments preferred
• Excellent analytical, documentation, and communication skills
• Experience in a regulated industry (PCI DSS, DPA, SOC2, etc.)
• Risk assessment and control design
• Regulatory and compliance analysis
• Audit coordination and remediation managementPolicy development and governance
• Stakeholder communication and influence