Cybersecurity Manager

We are seeking a Cybersecurity Manager to join Manulife Financial Corporation (MFC) under the Asia CISO organization. This role reports directly to the Asia Regional Office Security Officer and will serve as a Cybersecurity Manager within the BUSO Center of Excellence (BUSO CoE). The BUSO CoE, operating under the Asia CISO division, is dedicated to supporting Market Business Unit Security Officers (BUSOs) with specialized cybersecurity and technology control activities. The team partners closely with regional leaders and in‑country BUSOs to deliver core control execution, process improvements, and project‑driven initiatives. This includes reviewing high‑risk service requests, handling cyber incident per global process and regulatory expectations, conducting information security risk assessments, and executing, automating, and operationalizing foundational security processes.

Position Responsibilities:

• Lead and perform end-to-end Project Information Risk Assessments across Asia markets, from initial scoping and information criticality assessment through risk identification, control evaluation, risk treatment, remediation tracking, and business risk acceptance.
• Review assessments completed by market or designated assessors to ensure the consistent application of risk methodologies, control requirements, documentation standards, and quality expectations.
• Analyze project designs, architectures, data flows, technology components, third-party arrangements, and applicable security requirements to identify information security and operational risks.
• Translate assessment findings into clear risk statements and practical recommendations; advise project, technology, and business stakeholders on appropriate mitigation strategies and compensating controls.
• Monitor risk-treatment plans, commitments, exceptions, and risk acceptances; maintain assessment schedules and records, follow up on overdue actions, and escalate material or unresolved risks through the appropriate governance channels.
• Develop and maintain the regional information risk assessment framework, including playbooks, templates, procedures, training materials, quality assurance plans, standardized reporting, performance measures, and mechanisms for sharing best practices.
• Promote the information risk assessment program across Asia markets and provide guidance to market BUSOs, assessors, project teams, and other stakeholders to strengthen risk ownership and assessment quality.
• Provide application and information security consultation to project teams, technology partners, and business stakeholders, including facilitating specialized security assessments when required.
• Partner with market BUSOs and relevant control functions to identify operational security and risk-management activities suitable for centralization, standardization, automation, or transition to the CoE.
• Establish and maintain effective governance for CoE services, including service scope, roles and responsibilities, onboarding and offboarding procedures, reporting, service measures, issue management, and escalation paths.
• Deliver assigned centralized security and operational risk activities consistently and within agreed service expectations, including analysis of high-risk service requests and support for other BAU control processes.
• Support the end-to-end management and timely resolution of security incidents, particularly Data Loss Prevention incidents, in coordination with market BUSOs and relevant response teams.
• Provide regular status, risk, and performance updates to market BUSOs and regional stakeholders, highlighting key findings, trends, overdue actions, emerging risks, and matters requiring decision or escalation.
• Conduct knowledge transfer, coaching, and knowledge-sharing sessions for new team members, market assessors, and IT control and governance teams.
• Contribute to continuous improvement initiatives that enhance the effectiveness, efficiency, scalability, and consistency of regional security and risk-management processes.

Required Qualifications:

• University/College graduate with 3 – 5 years of progressive Cybersecurity experience, including 3+ years as an Information Security Officer.
• Solid background in Cybersecurity Management, Information Security Risk Assessment (both in project and BAU), Security Incident Response and Coordination, Access Review, Data Loss Prevention Management and other security processes like incident/crisis management, access management, vulnerability and patch management, as well as operational processes for business continuity and disaster recovery.
• Profound knowledge and understanding of Manulife’s Information Risk Management Framework (Risk Identification and Assessment, Risk Treatment, Risk Monitoring, Sustain and Independent Review), CIA Triad (Confidentiality, Integrity and Availability), Zero-Trust Tolerance.
• Expert in the following technologies: JIRA, ServiceNow, Devo, PowerBI, Confluence, Archer.
• Certifications: CISSP, CISM preferred; GCIH or incident response certifications advantageous.
• Strong knowledge of technology trends and financial services/insurance environments
• Self‑driven, organized, and able to meet objectives with minimal supervision
• Ability to break down complex issues into simple, actionable insights
• A collaborative team player who partners effectively with control functions to support timely project delivery
• Committed to continuous learning, improvement, and embracing change
• Strong problem‑solving capabilities, especially in fast‑paced or ambiguous situations
• Effective in managing escalations and regulatory interactions under pressure
• Excellent verbal and written communication skills, with the ability to explain technical concepts clearly
• Amenable to work in UP Ayala Technohub (Quezon City)
• Amenable to work in a hybrid set-up (3x onsite per week)
• Amenable to work in a day shift schedule

Preferred Qualifications:

• Professional certification in information security, technology risk, audit, or governance, such as CISM, CISSP, CRISC, CISA, or an equivalent credential.
• Experience in the financial services or insurance industry, including familiarity with regulatory, privacy, and operational resilience expectations.
• Knowledge of recognized security and governance frameworks, such as ISO/IEC 27001, the NIST Cybersecurity Framework, COBIT, or equivalent standards.
• Experience supporting regional or multi-market security programs, a Center of Excellence, or a shared-services operating model.
• Demonstrated experience standardizing, centralizing, automating, or improving information security and risk-management processes.
• Working knowledge of relevant workflow, governance, monitoring, reporting, and collaboration platforms, such as ServiceNow, Jira, Power BI, ProcessUnity, Confluence, Archer, Devo, or BlueCat Address Manager.
• Experience facilitating security assessments, consulting on application security risks, or coordinating remediation across technology and business teams.

When you join our team:

• We’ll empower you to learn and grow the career you want.
• We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words.
• As part of our global team, we’ll support you in shaping the future you want to see.