What Cybersecurity Jobs are in Manila?

Leads the enterprise Cyber Security Compliance Center by setting strategic direction for Information Security Management System (ISMS) governance, audit and assurance, identity and access management, and asset governance. Ensures sustained regulatory compliance, audit readiness, and continuous improvement of security controls across the organization through strong governance, disciplined remediation, and effective stakeholder engagement.

Cyber Security Compliance & Assurance

• Directs enterprise ISMS governance, ensuring effective design, implementation, and continuous improvement in alignment with ISO/IEC 27001 and applicable regulatory and contractual requirements.
• Manages internal, external, and regulatory audit programs, ensuring audit readiness, quality execution, timely closure of findings, and sustainable remediation of compliance gaps.
• Establishes audit governance frameworks, metrics, and reporting to provide transparency on compliance posture and control effectiveness.

Identity, Access & Asset Governance

• Governs enterprise-wide Identity and Access Management (IAM), ensuring secure, compliant, and efficient access to systems and data across the organization.
• Drives adoption of IAM technologies, automation, and control enhancements to support auditability, least‑privilege access, and segregation of duties.
• Oversees asset management and classification governance, ensuring accurate asset identification, valuation, ownership, and registry integrity across the asset lifecycle.

Risk, Control Alignment & Regulatory Conformance

• Ensures alignment of ISMS, asset, and access controls with enterprise risk management, regulatory obligations, and industry standards.
• Interprets evolving regulatory and standards requirements and translates them into practical, auditable control and process enhancements.

Program & Delivery Oversight

• Ensures timely, high‑quality delivery of compliance assessments and security initiatives in collaboration with Capability and Delivery teams.

People Leadership & Center Management

• Leads, mentors, and develops ISMS auditors, IAM, and asset governance teams, fostering a culture of accountability, continuous improvement, and audit excellence.
• Provides regular performance feedback, supports professional development, and ensures effective succession planning for critical roles.

Operational & Strategic Support

• Provides leadership and subject‑matter expertise for additional initiatives as assigned, ensuring alignment with organizational priorities and cybersecurity strategy.

Qualifications

EDUCATION

• Bachelor’s degree in Information Technology, Computer Science, Engineering, Accountancy, or any related course/discipline.
• Post‑graduate studies or professional training in Cybersecurity, Risk Management, Audit, or Governance is an advantage.

WORK EXPERIENCE

• Over 5 years of progressive leadership experience in IT and cybersecurity, with strong specialization in ISMS, audit and assurance, Governance, Risk, and Compliance (GRC)
• Proven expertise in leading enterprise‑wide internal, external, and regulatory audits aligned with ISO/IEC 27001 and NIST CSF, including audit readiness, remediation, and issue closure.
• Demonstrated ability to work across business, technology, and risk teams to strengthen security control maturity and maintain alignment with evolving regulatory and industry standards.

Qualifications:

• 3 - 5 years of experience in cybersecurity audits, threat and risk assessments (TRA), security risk management, and assessments of organizations, third-party environments, or technology solutions.
• Strong knowledge of cybersecurity frameworks (e.g., NIST CSF, NIST 800-30, NIST AI RMF, ISO 27001, SOC 2, PCI DSS, CIS Controls, OWASP LLM/GenAI guidance, etc.).
• Hands-on experience with security risk assessment tools and methodologies.
• Understanding of security operations, threat intelligence, and incident response.
• Proficiency in network security, cloud security (AWS, Azure, GCP), application security, data security, and third-party/vendor risk considerations.
• Experience assessing enterprise applications, cloud services, integrations/APIs, vendor platforms, and AI-enabled or generative AI solutions is preferred.
• Certifications preferred:

o CISA (Certified Information Systems Auditor)

o CISSP (Certified Information Systems Security Professional)

o CRISC (Certified in Risk and Information Systems Control)

Responsibilities:

• Conduct cybersecurity risk assessments, threat and vulnerability assessments, and compliance reviews across organizations, technology environments, and digital solutions.
• Assess security risks across enterprise applications, cloud platforms, APIs/integration environments, third-party solutions, and AI-enabled or generative AI technologies.
• Evaluate cybersecurity controls, policies, governance practices, and technical safeguards against industry frameworks such as NIST, ISO 27001, SOC 2, PCI DSS, and OWASP guidance.
• Identify cyber threats, attack vectors, and control gaps while providing practical recommendations to strengthen security posture and resilience.
• Review security architecture and technical controls including access management, data protection, encryption, cloud security, application security, and vendor risk management.
• Develop comprehensive risk assessment reports, documentation, and executive summaries; communicate findings and recommendations to technical teams and senior stakeholders.
• Collaborate with business and technology teams to align cybersecurity strategies with organizational objectives and risk management goals.

Responsibilities:

• Conduct cyber assessments for organizations, technology environments, and solutions (e.g., threat & risk assessments, cyber maturity assessments, compliance assessments, due diligence, solution assessments, and AI-enabled solution assessments) to identify security gaps, vulnerabilities, and risks.
• Assess diverse solution types, including enterprise applications, cloud platforms, data/integration pipelines, third-party or vendor solutions, and AI-enabled or generative AI solutions.
• Evaluate security policies, procedures, governance practices, and technical controls to ensure compliance with industry standards such as NIST CSF, NIST 800-30, ISF IRAM2, ISO 27001, NIST AI RMF, OWASP LLM/GenAI guidance, etc., where applicable.
• Identify cyber threats, attack vectors, and potential risks impacting business operations and solution delivery.
• Evaluate solution-specific risks and controls, including access management, data protection, secure configuration, API/integration security, vendor dependencies, and AI-related risks such as prompt injection, data/model poisoning, model theft, and excessive agency.
• Recommend risk mitigation strategies to strengthen organizational cyber resilience.
• Provide cyber risk assurance by aligning security controls with business objectives.
• Assess the effectiveness of technical security controls such as access management, encryption, endpoint security, network security, and cloud security.
• Recommend improvements to security architecture and IT infrastructure to reduce cyber risks.
• Prepare detailed assessment reports, risk assessment documentation, and executive summaries.
• Present security risks findings and recommendations to senior leadership and technical teams.

Qualifications:

• Bachelor’s or Master’s degree in Cybersecurity, Information Security, Computer Science, or a related field.
• 3-7 years of experience in cybersecurity audits, threat and risk assessments (TRA), security risk management, and assessments of organizations, third-party environments, or technology solutions.
• Strong knowledge of cybersecurity frameworks (e.g., NIST CSF, NIST 800-30, NIST AI RMF, ISO 27001, SOC 2, PCI DSS, CIS Controls, OWASP LLM/GenAI guidance, etc.).
• Hands-on experience with security risk assessment tools and methodologies.
• Understanding of security operations, threat intelligence, and incident response.
• Proficiency in network security, cloud security (AWS, Azure, GCP), application security, data security, and third-party/vendor risk considerations.
• Experience assessing enterprise applications, cloud services, integrations/APIs, vendor platforms, and AI-enabled or generative AI solutions is preferred.
• Excellent analytical, problem-solving, and communication skills.
• Ability to work collaboratively with technical and non-technical stakeholders.
• Certifications preferred:
• CISA (Certified Information Systems Auditor)
• CISSP (Certified Information Systems Security Professional)
• CRISC (Certified in Risk and Information Systems Control)

Working Set-up: Hybrid - 1-2x a week ONSITE / Nightshift

Office Location: Makati (Ayala or Legazpi Village site)

Is this your next challenge in Cybersecurity Architecture?

The challenge is to:

The Assistant Manager for Cyber Security Architecture is responsible for leading Vulnerability and Exposure Management, secure architecture design, and cyber risk transformation initiatives across the enterprise and digital platforms. This role acts as a bridge between engineering, operations, compliance, and architecture functions, driving proactive vulnerability identification, solution design, and governance maturity.

The incumbent will oversee multiple cybersecurity capabilities across vulnerability management, attack surface management, cloud security posture management, and application security, integrating their outputs into actionable, risk-based programs and dashboards to improve the organization’s cyber resilience posture.

Key Responsibilities

Vulnerability and Exposure Management

• Oversee vulnerability scanning and remediation processes for infrastructure and web applications.
• Troubleshoot technical issues related to scanning agents and tasks, ensuring optimal coverage and reliability.
• Maintain accurate asset tagging and metadata to enhance asset visibility and reporting precision.
• Consolidate vulnerability findings across platforms and coordinate remediation plans with system owners and security champions.
• Collaborate with ITSM/CMDB teams for asset data synchronization and process automation.
• Review and validate external exposure findings; guide system owners in interpreting reports and confirming remediation actions.
• Establish tagging and grouping conventions for asset identification and accountability.
• Cascade exposure reports to relevant teams and advise Security Operations on prioritization strategies.
• Support cloud teams in fine-tuning security alerts and managing risk remediation for cloud workloads.
• Work with Digital and Engineering teams to integrate security scanning within development pipelines (e.g., repositories, CI/CD, IDEs).
• Coach developers on secure coding practices, dependency management, and repository hygiene.
• Drive the transition from traditional vulnerability management to a risk-based exposure management approach for critical assets.
• Conduct internal workshops and awareness training for security champions to enhance risk understanding and remediation focus.

Security Architecture and Risk Assessment

• Partner with Risk & Compliance and Enterprise Architecture teams to conduct threat modeling and review new/existing system designs.
• Ensure all architecture principles align with internal Information Security Policy and external compliance frameworks (e.g., ISO 27001, NIST).
• Participate in architecture forums to ensure new initiatives meet defined cybersecurity assessment requirements.

Governance, SOP, and Dashboarding

• Develop and maintain Standard Operating Procedures (SOPs) for cybersecurity tools and processes to enforce governance consistency.
• Map SLAs to patch management policies and monitor adherence through structured reporting.
• Publish real-time vulnerability and exposure insights and metrics in dashboards for management visibility and decision support.

Roadmap Development

• Contribute to the cybersecurity solutions roadmap supporting strategic goals.
• Identify opportunities for automation, process improvement, and technology integration within the cyber architecture domain.

Do you have experience in Cybersecurity Architecture?

Qualifications and Experience

• Bachelor’s degree in Cybersecurity, Computer Science, or related technology discipline.
• 5–8 years of combined experience in cybersecurity architecture, Vulnerability and Exposure Management, and risk assessment.
• Extensive hands-on experience across vulnerability management, attack surface management, cloud security, and application security platforms.
• Strong understanding of risk-based vulnerability management, ISO 27001, and NIST CSF frameworks.
• Familiarity with OWASP, CI/CD pipelines, DevSecOps, and cloud security architecture (AWS, Azure, or GCP).
• Experience with asset management and CMDB/ITSM integrations.
• Effective stakeholder management and collaboration skills across technical and non-technical groups.

Preferred Certifications

• CISSP, CompTIA CySA+, CASP+, or equivalent.
• Certifications related to vulnerability management, cloud security, or security operations.
• Microsoft or cloud security-related certifications.

Core Competencies

• Analytical and problem-solving mindset with strong technical depth.
• Ability to translate complex vulnerabilities into business risk and mitigation actions.
• Excellent communication and presentation skills for technical and executive audiences.
• Self-motivated, structured, and capable of managing multiple concurrent projects.

COMPANY OVERVIEW

ASTRIA is a Filipino-owned company based in Manila and a trusted partner of leading global Digital Forensics and Cybersecurity solution providers. We deliver digital investigative tools, forensic hardware, professional services, and specialist training to organizations across the Philippines and Southeast Asia. As digital forensics is still an emerging field locally, we do not expect prior experience selling forensic solutions. We value candidates with strong sales skills, a solid IT foundation, curiosity, and the ability to learn technical concepts quickly.

WHY JOIN ASTRIA?

Sell Solutions That Matter: You will help organizations respond to cyber incidents, investigate misconduct, preserve digital evidence, and improve their ability to understand what happened after a breach, fraud, data leak, criminal case, regulatory issue, or internal investigation.

Build a Developing Market: Digital forensics is not yet a saturated market in the Philippines. This role gives you the opportunity to help shape how corporate, enterprise, and public-sector clients understand and adopt forensic tools, hardware, training, and investigation services.

Own High-Value Opportunities: You will own and drive opportunities across corporate, enterprise, and public-sector accounts, engaging stakeholders across IT, cybersecurity, compliance, legal, risk, HR, procurement, law enforcement, technical teams, and executive leadership.

Learn a Specialist Technical Domain: You do not need to be a forensic examiner. However, you should be comfortable learning how computers, mobile devices, storage, networks, cloud systems, and evidence workflows fit together.

Work Closely With Technical Experts: You will collaborate with Astria’s technical and leadership teams, but you must be able to conduct early discovery, qualify opportunities, and hold practical IT conversations without needing full technical shadowing on every call.

High Impact, High Ownership: ASTRIA is a focused, growing company. Your work will directly affect pipeline, revenue, client relationships, and the development of digital forensics capability in the region.

ROLE DESCRIPTION

ASTRIA is seeking a Sales Manager to drive sales of Digital Forensics, Incident Response, Cybersecurity, Forensic Hardware, and Professional Services solutions across corporate, enterprise, and public-sector clients in the Philippines.

This is an individual contributor role for someone who can generate opportunities, qualify client needs, manage complex sales cycles, and work with technical teams to position the right solution.

The ideal candidate does not need prior digital forensics sales experience. However, they must have enough basic IT literacy to understand and discuss topics such as laptops, servers, storage, hard drives, SSDs, RAM, networking, cloud versus on-premise environments, mobile devices, and cybersecurity operations.

KEY RESPONSIBILITIES:

• Own and achieve sales targets across corporate, enterprise, and public-sector accounts.
• Build and manage a pipeline across sectors such as banking, telecommunications, BPO, legal, insurance, energy, technology, government, law enforcement, and other regulated or high-risk environments.
• Prospect into organizations and agencies that need digital investigation, incident response, forensic tools, forensic hardware, training, or professional services.
• Engage stakeholders across IT, cybersecurity, compliance, risk, legal, HR, procurement, technical teams, executive leadership, and public-sector decision makers.
• Qualify opportunities by understanding client needs, budget, urgency, stakeholders, technical environment, procurement route, and decision process.
• Position Digital Forensics solutions within broader cybersecurity, incident response, investigation, compliance, legal, regulatory, and public-safety needs.
• Identify whether a client needs software, hardware, training, professional services, managed services, or a phased capability-building approach.
• Conduct early-stage discovery around devices, endpoints, storage, evidence handling, cloud/on-premise preferences, incident response workflows, investigation requirements, and reporting needs.
• Work with Astria’s technical team to prepare proposals, solution recommendations, demonstrations, and proof-of-concept plans.
• Manage end-to-end sales cycles from prospecting to closing.
• Respond to RFPs, RFIs, TORs, procurement documents, bid requirements, and client clarification requests.
• Maintain accurate CRM records, pipeline updates, forecasting, and account plans.
• Represent Astria in client meetings, partner meetings, industry events, webinars, training sessions, and cybersecurity or public-sector forums.
• Avoid overpromising; ensure proposed solutions match client capability, budget, procurement requirements, and technical needs.

REQUIRED QUALIFICATIONS:

• 3+ years of B2B sales, account management, business development, solution sales, or IT sales experience.
• Experience selling to corporate, enterprise, government, public-sector, or regulated clients in the Philippines.
• Practical understanding of basic IT concepts, such as: laptops, desktops, servers, and workstations; hard drives, SSDs, NAS, storage, backup, and data retention; RAM, CPU, compute, and basic hardware sizing; networking, firewalls, VPNs, bandwidth, and connectivity; cloud versus on-premise environments; mobile devices versus PCs; cybersecurity, incident response, or IT operations at a high level.
• Ability to learn technical concepts quickly and explain them clearly to non-technical and semi-technical buyers.
• Strong discovery and qualification skills.
• Ability to identify economic buyers, technical evaluators, business sponsors, procurement stakeholders, end users, internal champions, and public-sector influencers.
• Strong written and verbal communication skills.
• Ability to prepare clear proposals, follow-up emails, opportunity summaries, and business-case materials.
• Comfortable working independently while coordinating with technical and leadership teams.
• Experience with CRM tools or structured pipeline management.
• Bachelor’s degree or equivalent professional experience.

PREFERRED QUALIFICATIONS

The following are helpful but not mandatory:

• Experience selling cybersecurity, IT infrastructure, cloud, endpoint, SOC, SIEM, backup, storage, networking, or incident-response-related solutions.
• Experience working for a system integrator, IT reseller, cybersecurity vendor, managed service provider, distributor, public-sector technology supplier, or enterprise technology company.
• Existing network across IT, cybersecurity, compliance, risk, legal, HR, public-sector, law enforcement, government, or executive teams.
• Familiarity with enterprise procurement, government procurement, RFPs, RFIs, TORs, bid submissions, and multi-stakeholder sales cycles.
• Exposure to government, law enforcement, public safety, regulated-sector, or enterprise sales.
• Technical curiosity demonstrated through personal or professional interest in computing, cybersecurity, gaming PCs, building computers, networking, or IT systems.

WHAT WE DO NOT EXPECT ON DAY ONE

We do not expect candidates to:

• have deep digital forensics sales experience;
• know forensic tools already;
• conduct forensic examinations;
• design a complete forensic lab architecture alone;
• act as a presales engineer;
• know every cybersecurity or incident response concept in depth.

WHAT WE DO EXPECT

We do expect candidates to:

• understand basic IT fundamentals or learn them quickly;
• ask sensible technical discovery questions;
• be comfortable discussing devices, storage, endpoints, networks, and cloud/on-premise differences;
• understand that public-sector and enterprise opportunities often involve formal procurement, technical evaluation, and careful requirements matching;
• know when to involve technical colleagues;
• avoid making unsupported technical promises;
• write clearly;
• manage opportunities with discipline;
• reduce workload for the team rather than create unnecessary technical dependency.

EXAMPLE CLIENT PROBLEMS YOU MAY HELP ADDRESS

• A company suffered a data breach and needs to understand what happened.
• A bank wants to reduce reliance on external forensic consultants.
• A public-sector agency wants to build or improve digital forensic capability.
• A law enforcement unit needs tools, hardware, and training to process digital evidence.
• A legal or HR team needs defensible evidence for an internal investigation.
• A corporation wants to investigate data theft, fraud, employee misconduct, or policy breaches.
• A security team needs tools and training to collect and analyze endpoint evidence.
• An organization needs forensic hardware, evidence storage, audit trails, and reporting workflows.
• A client needs help deciding whether to buy tools, outsource investigations, or build internal capability over time.

WHAT WE OFFER

• Competitive base compensation with performance-based incentives.
• Exposure to high-value cybersecurity and forensic opportunities.
• Training and mentoring in digital forensics, forensic hardware, and incident response solutions.
• Opportunity to build a specialist sales career in an emerging market.
• Direct access to leadership and technical experts.
• Collaborative, practical, and mission-driven working environment.
• Opportunity to help raise digital investigation and cyber resilience standards in the Philippines and Southeast Asia.

If you have strong sales discipline, practical IT curiosity, and the ability to learn specialist technical solutions quickly, we would like to hear from you.

Please send your updated CV and a brief cover letter to

Job Title:

Technology Risk & Cyber Security Senior Associate /

Advisory Services – Digital Trust Services Senior Associate

Company: Reyes Tacandong & Co.

Location: Makati City

Job Overview:

The Senior Associate will support the delivery of Digital Trust Services, focusing on IT assurance, cybersecurity, and resiliency services for clients. This role involves assisting in audits, assessments, compliance reviews, and consulting engagements to help clients strengthen their IT controls, security posture, and business continuity capabilities.

Responsibilities include gathering and analyzing data, documenting findings, and contributing to client reports and recommendations. The Senior Associate will also assist in researching emerging trends in security, compliance, and IT risk management to support client engagements. Strong analytical skills, attention to detail, and a willingness to learn in fast-paced consulting environment are essential for effectively performing in this role.

Duties and Responsibilities:

• Assist in delivering IT assurance, cybersecurity, and resiliency services for clients, including planning, assessments, and execution of related tasks.
• Assist in preparing audit documentation, reports, and deliverables for clients.
• Assist in client meetings and presentations to communicate insights and recommendations.
• Support the development and maintenance of client relationship by ensuring high levels of client satisfaction.
• Stay updated on industry trends, best practices, and emerging technologies, while applying innovative thinking to enhance service delivery.
• Uphold professional standards, ethical guidelines, and quality in all interactions with clients and colleagues.

Qualifications:

• Bachelor’s degree in Accountancy , Internal Audit, Management Accounting, or any other business-related or accounting course.
• Must be a Certified Public Accountant (CPA) board passer.
• Certifications such as Certified Internal Auditor (CIA), and Certified Information Systems Auditor (CISA) are an advantage but not required.
• Prior experience in IT auditing, information security, or related fields is an advantage.

Skills and Experience:

• Strong written and verbal communication skills to document findings and convey information clearly to both technical and non-technical stakeholders.
• Basic understanding of IT systems, networks, and security concepts.
• Careful attention to detail in all tasks, from collecting data to documenting and preparing reports.
• Enthusiasm for learning new skills, staying up-to-date with industry trends, and adapting to evolving technologies and methodologies.
• Strong problem-solving skills, with the ability to think critically and logically when faced with challenges.
• Ability to work well with cross-functional teams and actively contribute to team goals.

How to Apply:

If you are a passionate and qualified professional ready to embark on a challenging yet rewarding career path with one of the country's leading firms, we encourage you to apply!

Please submit your updated resume to ( ) with the subject line: Advisory Services – Digital Trust Services Senior Associate - (Your Full Name)

Why Join Us?

Be part of one of the Philippines' leading audit and consulting firms—be part of RTeam!

At Reyes Tacandong & Co., we are committed to excellence and professionalism in the ever-evolving business landscape. Our people are our greatest asset, and we invest heavily in their growth through training, mentorship, and leadership development. With direct guidance from our firm’s partners, you will have the opportunity to work in a dynamic environment that fosters career advancement and personal growth.

Join us and take the next step in your professional journey!

I. Job Summary

The Cyber Security Administrator role is to perform the identification, investigation and resolution of security breaches detected by the in-placed security solutions and in Cloud applications.

The Cyber Security Administrator is involved in the evaluation and implementation of new security solutions, participation in the creation and or maintenance of policies, standards, baselines, guidelines and procedures as well as conducting vulnerability audits and assessments including administration and management on the various complete security requirements for Cloud.

II. Duties and Responsibilities

• Participate in the planning and design of enterprise security architecture, under the direction of the Security Administration Section Head, where appropriate.
• Participate in the creation and maintenance of IT security documents (policies, standards, baselines, guidelines and procedures) under the direction of the Security Administration Section Head, where appropriate.
• Participate in the planning and design of an enterprise Business Continuity Plan and Disaster Recovery Plan, under the direction of the Security Administration Section Head, where appropriate.
• Ensure compliance with information security policies and procedures and other recommended security requirements from both internal and external auditors.
• Recommend additional security solutions or enhancements to existing security solutions to improve overall enterprise security.
• Perform deployment, integration and initial configuration of all new security solutions.
• Perform enhancements to existing security solutions in accordance with standard best operating procedures generically and also specific to enterprise’s security documents.
• Maintain and monitor operational configuration of all in-placed security solutions per established baselines.
• Participate in the design, execution and investigation on related security issue and of vulnerability assessments, penetration tests and security audits.
• Handle service request and provide on-call support for end users for all in-place security solutions. Such as

o Granting of Internet access

o Granting access of USB ports

o Firewall change request

o Unblocking of website

o Blocking of spam email

o Deletion of separated employees from the system security solutions.

• Generates monthly security reports.
• Provides regulatory performance and status reports.
• Operation support for related end-users.
• Supports cost-cutting initiatives, programs and directives of the department, division and the Bank.
• Collaborates with Risk on implementation of various cloud security solutions/applications.
• Addresses process improvement in the management and administration of critical security appliance and device.
• Performs as backup for key SecAd Officers of the department.