Information Security Specialist

Key Responsibilities

Third-Party Security Risk Management

• Conduct security due diligence and risk assessments for vendors, suppliers, and third-party service providers.
• Evaluate third-party security posture through questionnaires, document reviews, and security ratings.
• Review vendor compliance with information security requirements prior to onboarding.
• Monitor and manage third-party security risks throughout the vendor lifecycle and recommend remediation actions.
• Maintain the Third-Party Risk Register and security assessment documentation.
• Lead or support Privacy Impact Assessments (PIAs).

Security Review of Contracts and Agreements

• Review contracts, Data Sharing Agreements (DSAs), NDAs, and service agreements for information security requirements.
• Ensure appropriate security, confidentiality, incident notification, access control, and data protection provisions are included.
• Collaborate with Legal, Procurement, and the Data Protection Officer (DPO) during contract negotiations.
• Recommend security requirements for cloud, SaaS, outsourcing, and managed service arrangements.

Security Awareness and Culture

• Develop and implement organization-wide information security awareness programs.
• Conduct phishing simulations, security campaigns, and awareness activities.
• Develop security advisories, educational materials, and role-based security training.
• Monitor and report awareness effectiveness using participation and phishing simulation metrics.

Security Audits and Assessments

• Conduct internal information security assessments against ISO/IEC 27001 and organizational security policies.
• Assess compliance with Data Privacy Principles, including Transparency, Legitimate Purpose, and Proportionality.
• Coordinate vulnerability assessments, security reviews, and corrective action tracking.
• Validate the implementation and effectiveness of security controls across business units.
• Support internal and external audits by preparing required evidence and documenting findings.
• Recommend continuous improvements to the Information Security Management System (ISMS).

Qualifications:

• Graduate of a 4-years IT / IS, CPA, Computer Eng'g course. Preferably with security license/certifications (i.e., ISO, ISACA) or equivalent.
• Minimum of five (3) years of experience in the field of information security and data privacy.
• Experience in ISMS implementation and /or certification
• Knowledge in ISMS ISO27001 standards (but not limited), guiding the development of InfoSec policy/standards/controls
• Knowledge in Data Privacy Act of 2012 and other relevant privacy regulations.
• Demonstrated hands-on experience in security risk and data privacy with proven methodology and structured approach
• Experience in an ISMS ISO27001/ISO27005 risk assessment technique, implementation and quality assurance audits