Cybersecurity Risk Lead (Hybrid Setup)

The Cybersecurity Risk Lead leads the organization’s cybersecurity risk management, information security governance, and compliance programme, while providing operational support for broader Governance, Risk, and Compliance objectives. The role identifies, assesses, treats, monitors, and reports cybersecurity and technology risks; coordinates assurance and compliance activities; supports enterprise risk, policy governance, business continuity, third-party risk, privacy, and control improvement initiatives; and advises leadership on cybersecurity, technology risk, data protection, resilience, and governance matters. The role works across business and support functions to translate regulatory, contractual, and organizational requirements into practical controls, accountable action plans, and decision-ready reporting that protect PSI’s information assets, systems, and operations.

Role Objective:
To proactively manage cybersecurity risks, strengthen information security governance, and ensure compliance with security requirements to protect PSI's information assets, support business resilience, and maintain stakeholder trust.

Key Responsibilities:

1. Cybersecurity Risk Management

• Lead the identification, assessment, evaluation, and monitoring of cybersecurity and technology-related risks across the organization.

• Develop and maintain the Cybersecurity Risk Register and ensure timely implementation of risk treatment plans.

• Conduct periodic cyber risk assessments for business processes, systems, applications, vendors, and projects.

• Monitor emerging cybersecurity threats, vulnerabilities, and industry trends that may impact the organization.

• Provide recommendations to reduce cyber risk exposure and strengthen security posture.

2. Information Security Governance

• Develop, implement, and maintain cybersecurity and information security policies, standards, procedures, and guidelines.

• Ensure cybersecurity practices are aligned with organizational objectives, industry best practices, and applicable frameworks.

• Facilitate periodic review and enhancement of security governance programs.

• Prepare cybersecurity and risk reports for executive leadership and governance committees.

• Promote a culture of cybersecurity awareness and accountability across the organization.

3. Compliance and Audit Management

• Ensure compliance with applicable laws, regulations, contractual obligations, and security standards.

• Coordinate internal and external cybersecurity audits, assessments, and client security reviews.

• Monitor compliance with information security policies and security control requirements.

• Track audit findings, security observations, and remediation activities to closure.

• Support certification and compliance initiatives (e.g., ISO 27001, SOC, Data Privacy requirements, client security standards).

4. Security Awareness and Training

• Lead the development and implementation of cybersecurity awareness and education programs.

• Conduct regular security awareness campaigns, phishing simulations, and employee training initiatives.

• Promote security best practices and strengthen the organization's human firewall against cyber threats.

5. Third-Party and Vendor Risk Management

• Conduct cybersecurity due diligence and security assessments for vendors, suppliers, and third-party service providers.

• Evaluate vendor security controls and monitor compliance with security requirements.

• Identify and mitigate third-party cybersecurity risks that may impact the organization.

6. Incident Management and Security Monitoring

• Support cybersecurity incident response activities, investigations, and post-incident reviews.

• Coordinate with internal teams and external partners during security incidents.

• Ensure cybersecurity incidents are properly documented, reported, and remediated.

• Monitor security metrics, trends, and key risk indicators to identify areas requiring attention.

7. Business Partnership and Advisory

• Serve as a trusted advisor to business leaders on cybersecurity, information security, and technology risk matters.

• Participate in business projects and technology initiatives to ensure cybersecurity risks are appropriately addressed.

• Provide practical and risk-based recommendations that support business objectives while maintaining security standards.

Key Performance Indicators (KPIs)

• Completion rate of annual cybersecurity risk assessments.

• Percentage of high-risk findings remediated within agreed timelines.

• Audit and compliance closure rate.

• Security awareness training completion rate.

• Reduction in repeat security findings and policy violations.

• Third-party security assessment completion rate.

• Cybersecurity incident response and resolution effectiveness.

• Overall cybersecurity maturity and risk posture improvement.

Qualifications:

Education

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Systems, Risk Management, or related field.

Experience

• Minimum 5–8 years of experience in Cybersecurity, Information Security, IT Risk, Compliance, or Governance.

• Experience conducting cyber risk assessments, security audits, and compliance reviews.

• Experience working with security frameworks and regulatory requirements.

• Experience engaging with senior stakeholders and cross-functional teams.

Preferred Certifications

• CISSP (Certified Information Systems Security Professional)

• CISM (Certified Information Security Manager)

• CRISC (Certified in Risk and Information Systems Control)

• CISA (Certified Information Systems Auditor)

• ISO 27001 Lead Implementer or Lead Auditor

• CDPSE (Certified Data Privacy Solutions Engineer)

Core Competencies

• Cybersecurity Risk Management

• Information Security Governance

• Technology Risk Assessment

• Regulatory Compliance

• Audit Management

• Security Awareness

• Incident Response

• Vendor Risk Management

• Stakeholder Management

• Strategic Thinking

• Analytical and Problem-Solving Skills

• Communication and Influencing Skills

• Business Acumen

Reporting Line

Reports to: Head of Finance

Direct Reports: NA

Benefits:

• HMO coverage on Day 1

• Statutory Benefits- SSS, Pag-ibig & Philhealth

• Meal Allowance

• Transportation Allowance

• Medicine and Optical Reimbursement Allowances

• 13th and 14th month Bonus

• Early Retirement Plan Package

• Group Life Insurance

• 30 days annual leave credits

• Annual Leave Conversion

• Free HMO Dependent

• Birthday Leave

• And more!!

APPLY NOW!