[Hiring] GRC Lead @Salmon Group

Role Description

You'll own information security risk management, control assurance, and ISO 27001 ISMS governance across a regulated group spanning banking, consumer finance, and technology.

What you'll do:

• Form an independent view of security risk and challenge whether proposed controls actually address it, working directly with the Group CISO.
• Assess control design and operating effectiveness across areas such as IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development.
• Turn risk and control data into clear, decision-ready reporting for governance forums.

What you'll own:

• Own the security risk process end to end: assessment, treatment, acceptance, monitoring, and reporting.
• Maintain the risk register and challenge risk assessments and treatment plans so residual risk, ownership, and remediation status stay current.
• Maintain the security control framework, test controls using evidence, data, sampling, or technical validation, and drive remediation with control owners.
• Maintain the ISO 27001 ISMS: policies and standards, Statement of Applicability, risk records, control evidence, exceptions, and key security registers.
• Track control deficiencies, findings, exceptions, and remediation actions.
• Define KRIs and control metrics, and flag where management decisions or escalation are needed.

Qualifications

• Strong practical experience in information security risk management: inherent and residual risk, treatment, acceptance, control effectiveness, risk appetite.
• Enough technical depth to critically assess controls across IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development.
• Hands-on experience reviewing or testing controls, with the ability to distinguish a documented control from an effective one.
• Working knowledge of ISO 27001, with the ability to turn complex risk and control information into concise management reporting.
• Comfortable working with GRC platforms, structured risk and control registers, and evidence management.

Benefits

• Ownership and flexibility.
• Fully remote work with core collaboration hours from 12:00 to 6:00 PM Manila time (UTC+8).
• Company-provided tools and equipment.
• Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits.
• Access to an internal mental health support specialist.
• 22 vacation days, Philippine public holidays, and 15 sick days.
• Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications.
• Company-sponsored trips to Manila to meet and work with your team in person.
• High-performing teams can earn a dedicated beach house week in Southeast Asia.