Head of Cyber Security

Head of Cybersecurity and Compliance

Location: Makati City, Philippines

Work Arrangement: Hybrid (Monday–Wednesday onsite; Thursday–Friday WFH)

Employment Type: Full-time

About the Opportunity

We are looking for an experienced Head of Cybersecurity and Compliance to lead the organization's information security, cybersecurity governance, risk management, and regulatory compliance functions.

This leadership position will oversee the development and implementation of security strategies, ensure the protection of critical business information and systems, and maintain compliance with applicable regulatory and industry standards.

Key Responsibilities

1. Cybersecurity Strategy and Governance

• Develop and implement the organization's overall cybersecurity and information security strategy.
• Establish and maintain security policies, standards, procedures, and governance frameworks.
• Lead the continuous improvement of the Information Security Management System (ISMS).
• Ensure security initiatives are aligned with business objectives and regulatory requirements.

2. Information Security and Risk Management

• Lead cybersecurity risk assessments, identify security vulnerabilities, and establish appropriate mitigation strategies.
• Oversee information security controls to protect critical systems, applications, networks, and organizational data.
• Monitor emerging cybersecurity threats, industry developments, and security trends.
• Drive security awareness and continuous improvement initiatives across the organization.

3. Security Operations and Incident Management

• Oversee cybersecurity operations, incident response, investigation, and remediation.
• Establish incident management processes to ensure timely identification, escalation, containment, and resolution of security incidents.
• Ensure appropriate security monitoring and response mechanisms are in place.

4. Regulatory Compliance and Audit Management

• Ensure compliance with applicable regulatory requirements, including the Credit Information Corporation (CIC) Advanced Tier requirements and the Philippine Data Privacy Act.
• Oversee compliance with ISO 27001, SOC 2, and relevant information security standards.
• Lead audit preparation, compliance assessments, and remediation of audit findings.
• Maintain comprehensive security documentation, control evidence, and risk reports.
• Represent the organization in regulatory discussions, audits, and compliance reviews.

5. Cloud and Infrastructure Security

• Oversee information security across cloud and on-premises environments.
• Work closely with the Head of IT Infrastructure to ensure appropriate security controls and infrastructure protection.
• Evaluate cloud security risks and ensure the implementation of appropriate security measures.
• Collaborate with technology teams on infrastructure resilience, business continuity, and disaster recovery requirements.

6. Vendor and Third-Party Risk Management

• Establish and oversee vendor security assessment and third-party risk management processes.
• Evaluate security risks associated with external service providers and technology partners.
• Ensure vendors meet applicable information security and compliance requirements.

7. Leadership and Stakeholder Management

• Lead, mentor, and develop the cybersecurity and compliance team.
• Establish team objectives, performance expectations, and development plans.
• Collaborate with technology leadership and cross-functional stakeholders on security initiatives.
• Provide management with updates on cybersecurity risks, compliance status, audit findings, and security improvements.

Qualifications and Requirements

• Bachelor's degree in Computer Science, Information Technology, Information Systems, or a related field.
• At least 7 years of relevant experience in Cybersecurity, Information Security, IT Risk Management, or IT Audit.
• At least 3–5 years of people management experience preferred. Candidates with at least 2 solid years of leadership experience may also be considered.
• Proven experience leading or managing an organization's information security, cybersecurity, or compliance functions.
• Strong knowledge of Governance, Risk, and Compliance (GRC), information security frameworks, and regulatory requirements.
• Hands-on experience with ISO 27001 and Information Security Management Systems (ISMS).
• Experience with SOC 2 compliance and audit requirements.
• Knowledge of the Philippine Data Privacy Act and regulatory compliance requirements.
• Experience managing cybersecurity risks across cloud and on-premises environments.
• Exposure to cloud security, preferably Alibaba Cloud.
• Strong experience in security audits, regulatory engagements, incident response, and vendor risk management.

Preferred Certifications

At least one of the following professional certifications:

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)

Experience with credit information systems or CIC regulatory requirements is an additional advantage.