Governance, Risk & Compliance (GRC) Manager

About the role The Governance, Risk & Compliance (GRC) Manager – Information Security & Data Privacy leads the organization's information security governance, data privacy, compliance, and management-system programs. The role owns the governance of the Information Security Management System (ISMS), supports continued ISO/IEC 27001 compliance, coordinates security and privacy assurance activities, and drives organization-wide policies, controls, risk management, audits, and continuous improvement. This is a cross-functional role working with Executive Management, IT, HR, Finance, Operations, Service Delivery, clients, auditors, certification bodies, and external partners. Key responsibilities Maintain and continuously improve the organization's ISMS in accordance with ISO/IEC 27001 Coordinate surveillance, recertification, internal, client, and other relevant security audits Maintain security policies, standards, risk registers, control requirements, exceptions, audit findings, and remediation actions Coordinate periodic security risk and control assessments with relevant business and technical owners Lead annual information security awareness activities Lead responses to client security questionnaires, RFP requirements, due diligence, and security assessments Maintain the organization's Data Privacy and Data Protection Program Monitor applicable Philippine and international privacy requirements relevant to the organization's operations and clients Maintain an integrated view of key compliance obligations, risks, audit findings, non-conformities, and corrective actions Coordinate investigations of information security, privacy, compliance, and significant operational incidents About you Bachelor's degree in Information Technology, Information Systems, Cybersecurity, Risk Management, Business, Legal Management, Industrial Engineering, or a related field At least 5 years of relevant experience in Information Security Governance, GRC, ISMS, Data Privacy, IT Risk, IT Audit, or Compliance Demonstrated experience with ISO/IEC 27001, including implementation, maintenance, audit, or certification activities Experience managing policies, risks, audit findings, remediation, and compliance assessments Experience engaging with auditors, clients, certification bodies, and senior stakeholders Strong knowledge of ISO/IEC 27001, GRC, risk, controls, audit, and compliance Working knowledge of Philippine data privacy requirements Strong policy, governance, investigation, and report-writing skills Strong analytical and root-cause-analysis capability Ability to translate regulatory and technical requirements into practical business controls