Total 2 job vacancies by QIMA

The Governance, Risk, and Compliance (GRC) team member will be reporting to the Head of Information Security and is responsible for supporting and enhancing the organization’s efforts to ensure adherence to policies, regulatory requirements, and industry security best practices. This role involves coordinating, executing, and overseeing various tasks related to governance, risk management, and compliance to protect the organization's assets, reputation, and ensure operational effectiveness.

The GRC specialist will work together with the Security Operations Leader, Security Operations Engineer, and QIMA internal stakeholders to meet the objectives of the audit requirements, identify risks present in the group, and to assess non-conformities and non-compliance against the organization’s Information Security Management System Policy and align the remediation plan with target dates against the respective owners.

The GRC specialist must have a good understanding of the different security and data privacy laws and regulations and industry security best practices with the ability to apply these standards to the QIMA environment.

Key Responsibilities:

1. Governance:
   • Develop, implement, and maintain policies, procedures, and frameworks to support QIMA’s organizational governance objectives.
   • Foster a culture of security, compliance and ethical behavior within the organization.
   • Conduct regular assessments and audits of governance processes to identify areas for improvement.
2. Risk Management:
   • Identify, assess, and prioritize risks for remediation that may impact the organization’s operations and overall security posture.
   • Develop risk mitigation strategies and monitor their effectiveness, until closure.
   • Maintain a risk register and ensure all risks are documented, evaluated, and tracked.
   • Collaborate with various departments to create and implement risk management plans.
3. Compliance:
   • Stay up to date with changing regulations and assess their impact on the organization.
   • Work with the Data Privacy Office and Legal teams to ensure the organization complies with all relevant laws, regulations, and standards.
   • Conduct regular internal reviews and identify non-conformities against QIMA’s Information Security Management System Policy that needs to be addressed.
   • Deploy regular security awareness to all employees and work with training team for security trainings and programs to be delivered to QIMA.
4. Documentation and Reporting:
   • Maintain accurate records of GRC activities, including policy documents, risk assessments, and compliance reports.
   • Prepare and present reports on governance, risk, and compliance activities to senior management and the board of directors.
   • Document incidents and breaches and manage remediation actions.
5. Collaboration and Communication:
   • Liaise with Security, IT, Compliance, Legal, HR, and other departments and stakeholders to ensure cohesive compliance and risk management efforts.
   • Act as a point of contact for regulatory bodies, auditors and client security requirements.
   • Provide guidance and support to all QIMA employees on GRC-related matters.

LOCATION: Cebu or anywhere in the Philippines

Key Responsibilities:  

• Monitor and manage day-to-day security alerts and incidents detected on QIMA anti-malware solutions. 

• Contain and remediate, escalated security incidents by working with IT support, IT Infrastructure, and/or Applications team. Document and implement changes to prevent potential recurrence. 

• Perform security event and network log analysis to identify other indicators of compromise across the QIMA environment.  

• Regularly review and develop strategies and procedures to handle security incidents ensuring that the QIMA incident response plan is up to date. 

• Maintain QIMA Business Continuity and Disaster Recovery Plans, and ensure that regular testing of plans are conducted based on agreed frequencies. 

• Perform regular security vulnerability assessment against QIMA applications and infrastructure. Document and report findings to the applicable teams (IT Infrastructure/Application Development Teams) to drive the completion on patching and remediation based on aligned SLAs. 

• Ensure compliance with legal and regulatory requirements, and internal and external audits related to information security. Assist in providing evidence to support QIMA’s compliance to any audit requirements. 

• Create and present regular reports on all deliverables stated to be presented to the Head of Information Security.