Security Specialist

I. Job Summary

The Security Specialist is responsible for protecting the company's information systems, networks, applications, and sensitive data against cybersecurity threats, unauthorized access, data breaches, and other security risks. The role oversees the implementation and monitoring of security controls, data protection measures, risk management practices, and compliance requirements under applicable data privacy and cybersecurity regulations. The Security Specialist works closely with IT, Technology, Operations, management, and relevant stakeholders to identify vulnerabilities, investigate security incidents, strengthen information security practices, and ensure that company systems and business processes adhere to established security standards and regulatory obligations. The ideal candidate must possess a recognized cybersecurity certification and have substantial experience in cybersecurity, data protection, information security risk management, and regulatory compliance.

II. Key Responsibilities 1. Cybersecurity Operations and Threat Management

• Monitor information systems, networks, applications, and endpoints for suspicious activities, vulnerabilities, and potential security threats.
• Implement and maintain appropriate security controls to protect company systems and information assets.
• Conduct vulnerability assessments, security reviews, and risk assessments.
• Coordinate security patching, configuration hardening, and remediation of identified vulnerabilities.
• Investigate security alerts and suspicious activities and recommend appropriate corrective actions.
• Monitor emerging cybersecurity threats and recommend preventive measures.
• Coordinate with IT teams and external service providers to address security weaknesses.

2. Information Security and Access Control

• Develop, implement, and maintain information security policies, procedures, standards, and guidelines.
• Review user access rights, privileged accounts, authentication controls, and access permissions.
• Support the implementation of multi-factor authentication, endpoint protection, encryption, and other appropriate security measures.
• Ensure access to confidential information is limited to authorized personnel based on business requirements.
• Monitor compliance with acceptable-use policies, password requirements, remote access controls, and other security procedures.
• Recommend improvements to system configurations and security architecture.

3. Data Protection and Privacy Compliance

• Support compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and regulations, and applicable National Privacy Commission (NPC) issuances.
• Coordinate with the Data Protection Officer (DPO) on privacy risks, data protection controls, and compliance initiatives.
• Help identify and document personal data processing activities, data flows, and information assets.
• Support the implementation of appropriate organizational, physical, and technical safeguards for personal and sensitive personal information.
• Assist in conducting Privacy Impact Assessments or Data Protection Impact Assessments, where applicable.
• Review data handling, storage, transmission, retention, disposal, and sharing practices to identify privacy and security risks.
• Support the implementation of data retention, access restriction, confidentiality, and secure disposal procedures.
• Assist in evaluating third-party vendors and service providers that process or access company or client data.
• Maintain records and documentation required for internal compliance monitoring and audits.

4. Security Incident and Data Breach Management

• Monitor, document, investigate, and coordinate responses to cybersecurity incidents and suspected data breaches.
• Assist in determining the nature, scope, impact, and potential causes of security incidents.
• Coordinate containment, eradication, recovery, and corrective actions with relevant teams.
• Maintain an incident register and ensure supporting evidence and investigation records are properly documented.
• Coordinate with the DPO, IT management, legal representatives, and other stakeholders when incidents involve personal data.
• Support breach assessment, notification preparation, and reporting within applicable regulatory deadlines, under the direction of authorized personnel.
• Conduct post-incident reviews and recommend measures to prevent recurrence.

5. Security Risk Management and Compliance

• Identify, assess, document, and monitor cybersecurity and information security risks.
• Maintain risk registers, treatment plans, security findings, and remediation trackers.
• Support the development and testing of business continuity, disaster recovery, and incident response procedures.
• Monitor compliance with applicable cybersecurity requirements, contractual security obligations, and internal policies.
• Assist with internal and external audits, compliance assessments, and evidence collection.
• Track corrective actions arising from audit findings and security reviews.
• Recommend improvements to security governance, risk management, and compliance processes.

6. Security Awareness and Training

• Develop or support cybersecurity and data privacy awareness programs for employees.
• Conduct briefings on phishing, social engineering, password security, data handling, confidentiality, and incident reporting.
• Prepare security advisories, awareness materials, and guidance for employees and supervisors.
• Monitor employee compliance with information security policies and recommend additional training where needed.

7. Security Documentation and Reporting

• Prepare periodic cybersecurity reports, risk assessments, incident summaries, and compliance updates.
• Maintain current security policies, procedures, asset records, incident logs, audit evidence, and remediation documentation.
• Present security findings and recommendations to IT management and other relevant stakeholders.
• Provide practical recommendations for strengthening security controls and reducing exposure to cyber threats.

III. Qualifications and Requirements

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, Information Systems, or a related field.
• Minimum of seven (7) years of relevant professional experience in cybersecurity, information security, data protection, or regulatory compliance. Must possess a recognized cybersecurity professional certification, such as: Certified Information Systems Security Professional (CISSP) Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA) CompTIA Security+ Certified Ethical Hacker (CEH) Certified in Risk and Information Systems Control (CRISC) Another recognized cybersecurity certification accepted by the company.
• Demonstrated experience in cybersecurity risk assessment, security controls, vulnerability management, and incident response.
• Strong knowledge of information security principles, access management, network security, endpoint protection, and data protection practices.
• Working knowledge of the Philippine Data Privacy Act of 2012, its implementing rules and regulations, and applicable NPC issuances.
• Experience supporting compliance audits, security assessments, incident investigations, and remediation activities.
• Familiarity with information security frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, or equivalent standards.
• Experience in preparing security policies, risk registers, incident reports, and compliance documentation.
• Strong analytical, investigative, documentation, and problem-solving skills.
• Excellent written and verbal communication skills. Ability to handle confidential information with discretion and integrity.

IV. Required Competencies

• Cybersecurity threat and vulnerability management
• Information security risk assessment
• Data protection and privacy compliance
• Security incident investigation and response
• Access control and identity management
• Security governance and compliance monitoring
• Audit preparation and documentation
• Security awareness and employee training
• Critical thinking and problem-solving
• Stakeholder coordination and communication
• Integrity, confidentiality, and accountability