SGV - Strategy, Risk, and Compliance - Senior Associate

SGV & Co.; Makati; On-site; PHP 1,200,000 - 2,000,000; Full time

Job summary

SGV & Co. is seeking a senior Cybersecurity professional in Makati to lead transformation engagements, assess risks, and drive compliance with industry standards.

You will shape security strategy, mentor teammates, and deliver client-ready reports and dashboards across diverse engagements. You will work with cross-functional teams to align cybersecurity initiatives with business objectives, foster growth, and maintain high standards of governance and confidentiality in a dynamic consulting

Qualifications

• Bachelor’s degree in IT, computer science, or related field.
• 5+ years in cybersecurity, risk management or compliance with hands-on auditing.
• Familiarity with ISO 27001, PCI DSS, HIPAA, NIST, COBIT and related standards.
• Experience with security assurance reports (SOC1/SOC2, ISO 27001 certificates).
• Willingness to obtain CISSP/CISA/CISM or equivalent certifications.

Responsibilities

• Lead cyber transformation engagements and develop security roadmaps.
• Perform security assessments of apps, vendors, and infrastructure.
• Ensure regulatory compliance and align initiatives with business goals.
• Produce client reports, dashboards, and governance materials.
• Guide juniors, review work, and support team performance reviews.
• Participate in internal training and mentorship programs.
• Foster strong client relationships and cross-functional teamwork.

Skills

Bachelor-level IT degree

Cybersecurity experience

Risk management

Compliance management

Auditing & testing

Security frameworks

Security governance

Strong communication

Mentoring teams

Certifications (CISSP/CISA/CISM)

Education

Bachelor's degree in IT / CS / CE / related field

Tools

GRC Technologies

Job description

SGV is the largest professional services firm in the Philippines. In everything we do, we nurture leaders and enable businesses for a better Philippines. This Purpose is our aspirational reason for being that ignites positive change and inclusive growth.

Our multidisciplinary teams work across a full spectrum of services in assurance, tax, strategy and transactions, and consulting. Enabled by data, AI and advanced technology, we help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

At SGV, we develop you with future-focused skills and equip you with world-class experiences. We empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams.

Technology Consulting - Cybersecurity

In Cybersecurity, we help organizations protect their digital assets and safeguard sensitive information from evolving threats. Our services include risk assessments, security strategy development, incident response planning, and compliance support. We provide tailored solutions to enhance security posture, mitigate vulnerabilities, and ensure regulatory compliance. By aligning cybersecurity initiatives with business objectives, we empower clients to build resilience and maintain trust in an increasingly complex digital environment.

As part of our Cybersecurity Consulting team, you will help lead cyber transformation engagements to enhance the organization's security postures and identify opportunities to improve organizational cybersecurity strategy, policy and governance. You will perform current state security assessments and support target operating model definition; manage discussions and propose approaches to aligning cybersecurity initiatives to strategic business objectives.

Your Key Responsibilities

• execute cyber security strategy, risk, and compliance projects with varying levels of complexity based on a defined approach and methodology. This may include:
  • Conducting cyber transformation engagements to enhance security postures
  • Conducting a maturity assessment and designing a security roadmap
  • Performing security assessment of new and existing applications, vendors, or infrastructure
  • Evaluating the compliance of clients against security standards such as ISO27001 ,NIST CSF, PCI DSS
  • Developing policy, standards and standard operating procedures
  • Conducting information risk assessments (e.g., Crown Jewel identification and Risk Classification) and propose appropriate mitigation strategies
  • Designing cybersecurity dashboards
• Provide guidance, coordinate and support teammates to execute the security strategy, risk and compliance projects
• Guide and review your peers and junior team members and provide timely and constructive feedback
• Prepare reports, documents and schedules that will be delivered to clients and other parties
• Conduct research to provide value adding advice to the client
• Contribute ideas with the team to complete and improve project output
• Help in performance reviews and contribute to performance feedback for staff/junior level team members
• Develop positive relationship with client personnel, peers and management
• Join and facilitate internal and external training, mentoring, learning and certification opportunities
• Participate in organization-wide people initiatives

Skills And Attributes For Success

What we look for

• A bachelor’s degree in IT, computer science, computer engineering, management, business administration, or any related field
• At least five (5) years of relevant experience in cybersecurity, risk management, compliance management, or internal audit with hands‑on experience in auditing, testing, assessing, designing, or implementing cybersecurity frameworks or regulations such as ISO 27001, PCI DSS, HIPAA, HITRUST, GDPR, CCPA, FISMA/FEDRAMP, COBIT, OWASP Top 10, NIST 800-53, security‑related BSP circulars
• Familiarity with security assurance reports such as ISO 27001 certificates, SOC1, SOC2, PCI- DSS AOC reports
• Good understanding of security practices on vulnerability assessment, penetration testing, network security, security operations, software development
• Proficient in leading and coaching teams
• Strong communication and presentation skills
• Desire to learn new techniques, frameworks, and technologies
• Willingness to take cybersecurity certifications and external training

Ideally, you’ll also:

• Relevant professional certification such as CISSP, CISA, CISM, CEH, ISO 27001 Lead Auditor or Lead Implementer
• Experience in working in consulting roles, interacting with clients, third parties or security vendors
• Good understanding of web services, distributed systems or mobile applications
• Good understanding of secure software development lifecycle, DevSecOps
• Good understanding of cloud security and modern architecture
• Hands on experience with IT security (application security, threat modeling, vulnerability assessment, penetration testing, security operations)
• Experience in working with GRC Technologies

What We Offer You

• Developing an extraordinary you – Gain access to world‑class training, coaching, and hands‑on experience that will build your skills, sharpen your expertise, and prepare you for leadership opportunities.
• Empowering an extraordinary you – Thrive in a flexible and supportive work environment that prioritizes wellbeing, embraces our values, and helps you achieve both professional success and personal fulfillment.
• Fueling an extraordinary you – Be part of an inclusive, diverse culture where collaboration and innovation drive impactful work, and where you’re inspired and challenged by teams who bring out your best.

SyCip, Gorres, Velayo & Co. (“SGV”) is a general professional partnership duly organized and existing under Philippine laws. SGV is also a member firm of the global network of Ernst & Young (“EY”) firms, each of which is a separate and distinct legal entity. Please note that your application will be received and processed by SGV with understanding that you are applying with SGV. As part of the process through this Career Site, you may receive an automated e‑mail notification from an EY email address.

We will process your Personal Data in accordance with the Data Privacy Act of 2012 and its implementing rules and regulations. You may access SGV’s Comprehensive Data Policy at https://www.sgv.ph/dpa for all Personal Data we may collect or receive from you.

SGV | Building a better working world.

SGV & Co. is a member firm of Ernst & Young Global Limited. EY refers to the global organization, and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets. Fueled by sector insights, a globally connected, multidisciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories. Information about how EY collects and uses personal data and a description of the rights individuals have under data protection legislation are available via ey.com/privacy. EY member firms do not practice law where prohibited by local laws. For more information about our organization, please visit sgv.ph.

© 2026 SyCip Gorres Velayo & Co. All Rights Reserved.