Strategic Information Security Risk Lead

Metrobank; Philippines; On-site; PHP 650,000 - 900,000; Full time

Job summary

Metrobank is seeking a Security Assurance and Assessment Officer to develop and maintain the bank’s third-party information security risk management framework. The role ensures alignment with the enterprise risk strategy and reviews security controls across processes, systems, and assets.

Responsibilities include conducting risk assessments, evaluating vendors, and providing mitigation recommendations to protect confidentiality, integrity, and availability of information.

Qualifications

• Bachelor’s degree in a relevant field.
• Experience in IT general controls, auditing, and system security risk assessments.
• Ability to assess and prioritize security risks and communicate trade-offs.
• Experience in project security reviews and risk assessments.
• Strong analytical skills to identify risks and recommend actions.
• Knowledge of security best practices and emerging threats.
• Certifications such as CISA, CISM, CRISC, PCI-DSS, ISO 27001 are a plus.

Responsibilities

• Develop and implement plans for conducting information security, third-party, and system risk assessments.
• Identify critical assets, threats, and vulnerabilities, and evaluate the effectiveness of existing security controls.
• Assess and monitor the security performance of third-party vendors handling client data.
• Perform threat modeling and risk assessments for IT systems and assets.
• Evaluate the impact of process changes, system upgrades, and third-party engagements on security risks.
• Review and ensure adequate controls are in place to protect the confidentiality, integrity, and availability of information.
• Recommend and help develop information security policies and procedures based on assessment results.
• Coordinate with business units and stakeholders to gather information for risk assessments.
• Prepare and communicate risk assessment reports, including findings and recommended mitigation actions.
• Track and follow up on risk mitigation activities and maintain an updated risk register.
• Execute and monitor risk assessment plans and programs.
• Maintain proper documentation and records of assessments and security activities.
• Investigate security incidents related to information handling and data privacy.
• Stay updated on security trends, threats, and regulatory requirements, and apply them in daily work.
• Review, guide, and mentor junior risk assessors.
• Support continuous improvement of the bank’s information security programs and strategies.
• Perform other security risk and compliance tasks as assigned.

Skills

Analytical skills

Risk assessment

IT controls & auditing

Security reviews

Threat awareness

Education

Bachelor’s degree in a relevant field

Job description

Metrobank is seeking a Security Assurance and Assessment Officer to develop and maintain the bank’s third-party information security risk management framework. The role ensures alignment with the enterprise risk strategy and reviews security controls across processes, systems, and assets.

Responsibilities include conducting risk assessments, evaluating vendors, and providing mitigation recommendations to protect confidentiality, integrity, and availability of information.