Governance, Risk & Compliance (GRC) Manager

About the role

The Governance, Risk & Compliance (GRC) Manager – Information Security & Data Privacy leads the organization's information security governance, data privacy, compliance, and management-system programs. The role owns the governance of the Information Security Management System (ISMS), supports continued ISO/IEC 27001 compliance, coordinates security and privacy assurance activities, and drives organization-wide policies, controls, risk management, audits, and continuous improvement. This is a cross-functional role working with Executive Management, IT, HR, Finance, Operations, Service Delivery, clients, auditors, certification bodies, and external partners.

Key responsibilities

• Maintain and continuously improve the organization's ISMS in accordance with ISO/IEC 27001

• Coordinate surveillance, recertification, internal, client, and other relevant security audits

• Maintain security policies, standards, risk registers, control requirements, exceptions, audit findings, and remediation actions

• Coordinate periodic security risk and control assessments with relevant business and technical owners

• Lead annual information security awareness activities

• Lead responses to client security questionnaires, RFP requirements, due diligence, and security assessments

• Maintain the organization's Data Privacy and Data Protection Program

• Monitor applicable Philippine and international privacy requirements relevant to the organization's operations and clients

• Maintain an integrated view of key compliance obligations, risks, audit findings, non-conformities, and corrective actions

• Coordinate investigations of information security, privacy, compliance, and significant operational incidents

About you

• Bachelor's degree in Information Technology, Information Systems, Cybersecurity, Risk Management, Business, Legal Management, Industrial Engineering, or a related field

• At least 5 years of relevant experience in Information Security Governance, GRC, ISMS, Data Privacy, IT Risk, IT Audit, or Compliance

• Demonstrated experience with ISO/IEC 27001, including implementation, maintenance, audit, or certification activities

• Experience managing policies, risks, audit findings, remediation, and compliance assessments

• Experience engaging with auditors, clients, certification bodies, and senior stakeholders

• Strong knowledge of ISO/IEC 27001, GRC, risk, controls, audit, and compliance

• Working knowledge of Philippine data privacy requirements

• Strong policy, governance, investigation, and report-writing skills

• Strong analytical and root-cause-analysis capability

• Ability to translate regulatory and technical requirements into practical business controls