IT Risk Officer

About the role

Equicom Savings Bank, Inc. is seeking an IT Risk Officer (Department Head) to join our compliance and risk management team. This is a full-time position based in Makati City, Metro Manila.

As an IT Risk Officer, you will play a critical role in identifying, assessing, and mitigating information technology risks across the organisation.

This position is essential to ensuring that our bank maintains robust cybersecurity defences, regulatory compliance, and operational resilience in an increasingly digital banking environment.

You will be responsible for developing and implementing IT risk frameworks, policies, and controls that protect the bank's assets, systems, and customer data whilst supporting business objectives.

Reports to: Chief Risk Officer (CRO)

The IT Risk Head is responsible for overseeing the identification, assessment, and management of technology-related risks within an organization.

This role ensures that IT risk management strategies align with the company & broader business goals and regulatory requirements. The IT Risk Head develops and leads a team to implement policies and practices to safeguard the organization & technology infrastructure, data, and systems from potential threats, vulnerabilities, and incidents.

Key Responsibilities:

1. Risk Management Strategy:

o Develop and implement a comprehensive IT risk management framework aligned with business objectives, rgulatory requirements, and industry standards (e.g.,ISO 27001, NIST, GDPR).

o Define and maintain IT risk policies, procedures, and controls to identify, assess,

and mitigate risks in information systems, networks, and technologies.

o Advise senior management on key IT risk exposures and help prioritize risk

mitigation efforts based on potential business impact.

2. Risk Identification and Assessment:

o Conduct regular risk assessments, audits, and vulnerability assessments to proactively identify emerging risks and weaknesses in the IT environment.

o Develop and maintain risk registers to track identified risks, assessment results, and mitigation efforts.

3. Cybersecurity and Data Protection:

o Oversee the development and enforcement of cybersecurity policies, including

threat detection, incident response, and data protection strategies.

o Monitor and respond to cyber threats and attacks, ensuring the organization & IT systems are secure and resilient.

o Ensure compliance with data protection regulations (e.g., GDPR, CCPA, HIPAA)

and manage risks related to data privacy.

4. Governance, Compliance, and Reporting:

o Collaborate with internal and external auditors, regulators, and third-party vendors to ensure compliance with IT risk management standards and regulations.

o Prepare and present regular reports to senior management and the board of directors on the status of IT risk management, including key risk indicators and mitigation progress.

o Ensure IT policies, procedures, and controls are in place to meet industry standards and compliance requirements.

5. Incident Management and Response:

o Monitor the response to major IT incidents, such as data breaches, system outages, or cyberattacks, ensuring appropriate mitigation and recovery plans are in place.

o Coordinate with incident response teams and stakeholders to resolve incidents quickly, minimize damage, and prevent recurrence.

o Conduct post-incident reviews and analysis to identify lessons learned and improve risk management practices.

6. Collaboration:

o Collaborate with other departments (e.g., IT, legal, compliance, operations) to ensure cross-functional coordination in risk management efforts.

o Promote a risk-aware culture across the organization by conducting periodic training and awareness programs on IT risk, cybersecurity, and compliance.

7. Technology and Vendor Risk Management:

o Evaluate and manage risks related to the organization & technology stack, including software, hardware, cloud services, and third-party vendors.

o Assess IT vendor risks, ensuring third-party contracts contain appropriate risk mitigation clauses and service level agreements (SLAs).

o Monitor third-party IT vendors for compliance with organizational security and risk policies.

Qualifications:

Education:

o Bachelor’s degree in Information Technology, Cybersecurity, Computer Science,

or related field. A Master’s degree or certifications (e.g., CISSP, CISM, CRISC, CISA) is preferred.

Experience:

o 5-10 years of experience in IT risk management, cybersecurity, or IT governance, with at least 2 years in a leadership or managerial role.

o Extensive experience in risk assessments, incident management, and regulatory compliance.

o Experience with risk management frameworks (e.g., NIST, ISO 27001, COBIT) and IT governance best practices.

o Strong background in cybersecurity, data protection, and IT infrastructure.

Skills and Competencies:

o Excellent analytical, problem-solving, and critical-thinking skills.

o Strong leadership and team-building abilities.

o In-depth knowledge of IT risk management tools and techniques.

o Effective communication and stakeholder management skills.

o Ability to manage multiple complex projects simultaneously and meet deadlines.

o Strong understanding of emerging IT risks, such as cloud computing, AI, and IoT.