The Governance, Risk, and Compliance (GRC) team member will be reporting to the Head of Information Security and is responsible for supporting and enhancing the organization’s efforts to ensure adherence to policies, regulatory requirements, and industry security best practices. This role involves coordinating, executing, and overseeing various tasks related to governance, risk management, and compliance to protect the organization's assets, reputation, and ensure operational effectiveness.

The GRC specialist will work together with the Security Operations Leader, Security Operations Engineer, and QIMA internal stakeholders to meet the objectives of the audit requirements, identify risks present in the group, and to assess non-conformities and non-compliance against the organization’s Information Security Management System Policy and align the remediation plan with target dates against the respective owners.

The GRC specialist must have a good understanding of the different security and data privacy laws and regulations and industry security best practices with the ability to apply these standards to the QIMA environment.

Key Responsibilities:

1. Governance:
   • Develop, implement, and maintain policies, procedures, and frameworks to support QIMA’s organizational governance objectives.
   • Foster a culture of security, compliance and ethical behavior within the organization.
   • Conduct regular assessments and audits of governance processes to identify areas for improvement.
2. Risk Management:
   • Identify, assess, and prioritize risks for remediation that may impact the organization’s operations and overall security posture.
   • Develop risk mitigation strategies and monitor their effectiveness, until closure.
   • Maintain a risk register and ensure all risks are documented, evaluated, and tracked.
   • Collaborate with various departments to create and implement risk management plans.
3. Compliance:
   • Stay up to date with changing regulations and assess their impact on the organization.
   • Work with the Data Privacy Office and Legal teams to ensure the organization complies with all relevant laws, regulations, and standards.
   • Conduct regular internal reviews and identify non-conformities against QIMA’s Information Security Management System Policy that needs to be addressed.
   • Deploy regular security awareness to all employees and work with training team for security trainings and programs to be delivered to QIMA.
4. Documentation and Reporting:
   • Maintain accurate records of GRC activities, including policy documents, risk assessments, and compliance reports.
   • Prepare and present reports on governance, risk, and compliance activities to senior management and the board of directors.
   • Document incidents and breaches and manage remediation actions.
5. Collaboration and Communication:
   • Liaise with Security, IT, Compliance, Legal, HR, and other departments and stakeholders to ensure cohesive compliance and risk management efforts.
   • Act as a point of contact for regulatory bodies, auditors and client security requirements.
   • Provide guidance and support to all QIMA employees on GRC-related matters.

LOCATION: Cebu or anywhere in the Philippines

Key Responsibilities:  

• Monitor and manage day-to-day security alerts and incidents detected on QIMA anti-malware solutions. 

• Contain and remediate, escalated security incidents by working with IT support, IT Infrastructure, and/or Applications team. Document and implement changes to prevent potential recurrence. 

• Perform security event and network log analysis to identify other indicators of compromise across the QIMA environment.  

• Regularly review and develop strategies and procedures to handle security incidents ensuring that the QIMA incident response plan is up to date. 

• Maintain QIMA Business Continuity and Disaster Recovery Plans, and ensure that regular testing of plans are conducted based on agreed frequencies. 

• Perform regular security vulnerability assessment against QIMA applications and infrastructure. Document and report findings to the applicable teams (IT Infrastructure/Application Development Teams) to drive the completion on patching and remediation based on aligned SLAs. 

• Ensure compliance with legal and regulatory requirements, and internal and external audits related to information security. Assist in providing evidence to support QIMA’s compliance to any audit requirements. 

• Create and present regular reports on all deliverables stated to be presented to the Head of Information Security. 

As a Senior Cyber Security Analyst,

You will safeguard our infrastructure and users, minimizing risks posed by cyber threats. You will promptly and effectively handle cyber attacks and data breaches, ensuring minimal recurrence of incidents.

Some of the things we expect you to do are to:

• Assist in monitoring company compliance to IT security policies.
• Assist with incident response and execution of company security incident response plan.
• Monitor and manage security events and alerts from a variety of sources (Azure, Defender, Keeper, Cloudflare etc).
• Assess and mitigate CVE’s and CVSS’s from multiple threat intelligence sources.
• Monitor threat intelligence and ensure risk mitigation and communication through the company where necessary.
• Assist with cybersecurity and phishing training for staff.
• Assist in maintaining and implementing GPO policies in Azure.
• Implement Identity Management via SSO across all MS Azure compliant tools used by the business.
• Works with Network Specialist to manage and monitor VPN and firewall rules.
• Works with System Administrator manage and monitor Azure.
• Ensure that IT security audits are conducted periodically or as needed.
• Assist in the development and maintenance of the Business Continuity (BC) and Disaster Recovery (DR) plans.
• Assist in development, maintenance and testing of the company’s security incident response plan.
• Develop and understand all testing necessary for a successful BC/DR execution.
• Assist and mentor desktop support and end users when they need to install or learn about new security products and/or procedures.

We would need you to be or have the following:

• Understanding of risk, threats, and vulnerabilities.
• Strong grasp of technical security controls with practical implementation experience.
• Proficiency in Microsoft Intune and Defender.
• Competence in Certificates, MFA (Multi-Factor Authentication), Vulnerability Management, and Penetration Testing.
• Familiarity with the NIST Cybersecurity Framework.
• Experience with Microsoft Active Directory or certification.
• Knowledgeable in incident response principles.
• Familiarity with threat intelligence and frameworks like MITRE ATT&CK.
• Exposure to IS027001 and SOC2 security frameworks.
• Familiarity with different IT domains: Network, Infrastructure, Systems Administration, Software Development, Database Administration, Change Management, Incident Management.
• Prior experience with ISO documentation and standards.

It would be awesome if you are or also have: 

• Strong cybersecurity tooling (MDM, Endpoint protection, IDS, WAF, Password Manager)
• Ability to identify gaps and/or risk exposure in programs.
• Strong problem solving and organizational skills.
• Strong written/verbal communication skills.
• Able to interact with stakeholders in cross-functional teams.
• Good team player interested in sharing knowledge and cross-training other team members and shows interest in learning new technologies and products.
• Ability to create quality documents

Be a part of the Smartsourcing crew

Control Risks is currently looking for an experienced Security Director to be embedded with our client, a large multinational company, based in Mindanao, Philippines. This role will play a key part in the ongoing development of the client’s holistic security programme.

The Security Director will lead the security function and assume responsibility for the delivery of the security programme specific to the client's operations. The Security Director is tasked with the development of the security plan, which will assess threats, risks and resources. They will also coordinate security and incident training for local security officers. The Security Director will work closely with leaders from across the business, including Supply Chain, HR, Legal, IT, and Compliance areas. Effective engagement with third party security providers and government agencies is also required.

This position will be hired as an initial 1-year contract, with scope for further extension.

Responsibilities will include:

• Work with leadership team to analyse security threats and risks to the client's people and business. Implement security mitigation plans and establish relevant countermeasures. Escalate higher-level risks as required.
• Work with relevant teams to communicate security advice to travellers operating in high-risk locations.
• Work with business leaders to develop Incident Management plans. Support implementation of incident management framework.
• Oversee and ensure proper performance of the third party security guard companies engaged by the client.
• Create/update the security framework and ensure it is applied effectively.
• Conduct security risk assessments to validate effectiveness’ of security controls (people, processes and technology).
• Lead the implementation of effective and cost-efficient holistic security solutions.
• Conduct a physical security Risk Assessment for new sites or post major refurbishment, use or occupancy change, and major change to threat assessment.
• Understand and apply the full range of corporate investigative capabilities, whilst ensuring their lawful application.
• Coordinate and deliver security capability training required by employees, security teams and third-party partners.
• Possess contractual assessment skills for the implementation and review of security contracts.
• Prepare reports including security incident reporting, intelligence briefings, threats assessments and investigative reports.
• Utilise an active regional security network to share security information, trends and evolving operational practice. Participate in industry forums and understand emerging security technologies.

• 10+ years' experience in corporate security roles.
• Experience in a significant leadership role.
• Experience working within large complex corporate environments
• Strong English language skills and the ability to develop influential relationships with stakeholders at all levels of an organisation.
• Proficient IT (Microsoft Suite) skills.

Desired:

• Experience in developing and delivering training
• Experience working in the Philippines with insight into local working practices and cultures.

• Control Risks offers a competitively positioned compensation and benefits package that is transparent and summarised in the full job offer.
• We operate a discretionary global bonus scheme that incentivises, and rewards individuals based on company and individual performance.
• Control Risks supports hybrid working arrangements, wherever possible, that emphasise the value of in-person time together - in the office and with our clients - while continuing to support flexible and remote working.
• As an equal opportunities employer, we encourage suitably qualified applicants from a wide range of backgrounds to apply and join us and are fully committed to equal treatment, free from discrimination, of all candidates throughout our recruitment process.

Hi! We’re Smartsourcing, and we’re looking for a Azure Administrator who can work with us full-time and on-site!

Where?