Responsibilities:
- Conduct cyber assessments for organizations, technology environments, and solutions (e.g., threat & risk assessments, cyber maturity assessments, compliance assessments, due diligence, solution assessments, and AI-enabled solution assessments) to identify security gaps, vulnerabilities, and risks.
- Assess diverse solution types, including enterprise applications, cloud platforms, data/integration pipelines, third-party or vendor solutions, and AI-enabled or generative AI solutions.
- Evaluate security policies, procedures, governance practices, and technical controls to ensure compliance with industry standards such as NIST CSF, NIST 800-30, ISF IRAM2, ISO 27001, NIST AI RMF, OWASP LLM/GenAI guidance, etc., where applicable.
- Identify cyber threats, attack vectors, and potential risks impacting business operations and solution delivery.
- Evaluate solution-specific risks and controls, including access management, data protection, secure configuration, API/integration security, vendor dependencies, and AI-related risks such as prompt injection, data/model poisoning, model theft, and excessive agency.
- Recommend risk mitigation strategies to strengthen organizational cyber resilience.
- Provide cyber risk assurance by aligning security controls with business objectives.
- Assess the effectiveness of technical security controls such as access management, encryption, endpoint security, network security, and cloud security.
- Recommend improvements to security architecture and IT infrastructure to reduce cyber risks.
- Prepare detailed assessment reports, risk assessment documentation, and executive summaries.
- Present security risks findings and recommendations to senior leadership and technical teams.
Qualifications:
- Bachelor's or Master's degree in Cybersecurity, Information Security, Computer Science, or a related field.
- 3-7 years of experience in cybersecurity audits, threat and risk assessments (TRA), security risk management, and assessments of organizations, third-party environments, or technology solutions.
- Strong knowledge of cybersecurity frameworks (e.g., NIST CSF, NIST 800-30, NIST AI RMF, ISO 27001, SOC 2, PCI DSS, CIS Controls, OWASP LLM/GenAI guidance, etc.).
- Hands-on experience with security risk assessment tools and methodologies.
- Understanding of security operations, threat intelligence, and incident response.
- Proficiency in network security, cloud security (AWS, Azure, GCP), application security, data security, and third-party/vendor risk considerations.
- Experience assessing enterprise applications, cloud services, integrations/APIs, vendor platforms, and AI-enabled or generative AI solutions is preferred.
- Excellent analytical, problem-solving, and communication skills.
- Ability to work collaboratively with technical and non-technical stakeholders.
- Certifications preferred:
- CISA (Certified Information Systems Auditor)
- CISSP (Certified Information Systems Security Professional)
- CRISC (Certified in Risk and Information Systems Control)
Working Set-up: Hybrid - 1-2x a week ONSITE / Nightshift
Office Location: Makati (Ayala or Legazpi Village site)
