Information Security Officer

We are looking for an Information Security Officer (ISO) to lead the company's information security governance, regulatory compliance, and risk management initiatives.

The role will ensure compliance with BSP regulations, ISO 27001, NIST frameworks, and the Data Privacy Act, while overseeing the effectiveness of security controls across cloud infrastructure and applications.

Key Responsibilities

• Lead the development, implementation, and enforcement of the company's Information Security Program in compliance with BSP regulations (including applicable circulars), ISO 27001, NIST, and the Data Privacy Act (RA 10173).
• Monitor and report on the company's security posture, risks, and incidents, ensuring appropriate controls and remediation measures are implemented.
• Develop and maintain information security policies, standards, and procedures aligned with regulatory and industry requirements.
• Conduct information security risk assessments and maintain risk registers and mitigation plans.
• Provide information security oversight in collaboration with Engineering and DevOps teams to ensure compliance with security policies and standards.
• Oversee security controls across AWS infrastructure and applications, including vulnerability assessments, penetration testing, and remediation activities.
• Coordinate security audits and regulatory assessments, ensuring identified gaps are addressed promptly.
• Oversee security incident reporting, investigation, and resolution.
• Drive information security awareness and training programs across the organization.
  
  

• Bachelor's degree in IT, Computer Science, Information Security, or a related field.
• At least 5 years of experience in information security, IT risk, security governance, or regulatory compliance.
• Familiarity with BSP regulations and compliance requirements within banking, fintech, or other regulated financial institutions.
• Knowledge of ISO 27001, NIST, AWS cloud security, application security, and DevSecOps practices.
• Experience in risk assessments, security audits, vulnerability management, and security control oversight.
• Certifications such as CISSP, CISM, CISA, CRISC, or ISO 27001 Lead Auditor/Implementer are preferred.