Cybersecurity Analyst (GRC-Focused)

Key Responsibilities:

• Assessments and Validations

  • Conduct control validations and gap assessments against CSF 2.0, ISO/IEC 27001:2022, and client requirements
  • Collect and organize evidence and record findings clearly and accurately.
  • Support internal and external audits

• Risk Support

  • Facilitate risk assessment sessions with process and control owners.
  • Keep the risk register updated, including owners, treatment actions, and due dates.

• Documented Procedures and Compliance

  • Develop and maintain clear, practical policies, procedures, work instructions, and checklists that teams can follow in day-to-day operations.
  • Ensure documents are aligned with applicable frameworks and are reviewed by senior staff before release.
  • Maintain document versions and the evidence repository.
  • Support compliance with the Data Privacy Act of 2012 (RA 10173) and related regulations.

• Stakeholder and Client Communication

  • Serve as a working-level contact for internal teams and clients on evidence requests, assessment schedules, and follow-ups.
  • Facilitate walkthroughs, meetings, and validation discussions, and prepare simple status updates.
  • Escalate concerns and scope questions to the GRC Manager.

Job Qualifications:

• Bachelor’s degree in information technology, Computer Science, Information Systems, Cybersecurity, or a related field.

• Cybersecurity training and exposure (courses, workshops, internships, or work experience).

• Demonstrated ability to write clear, structured, and usable documented procedures.

• Pragmatic approach: able to translate framework requirements into practical steps that fit how the organization or client actually works.

• Basic understanding of NIST CSF 2.0, ISO/IEC 27001, and risk management concepts.

• Good written and verbal communication skills in English.

• Ability to handle client and stakeholder interactions professionally.

• Working knowledge of Microsoft Office (Word, Excel, PowerPoint)

• Certifications (a plus, not required)

  • ISO/IEC 27001 Foundation
  • CompTIA Security+
  • ISC2 Certified in Cybersecurity (CC)
  • ITIL 4 Foundation