Job Description: IT Risk Manager
Location: BGC, Taguig (Hybrid)
Industry: Insurance
Employment Type: Full-Time
Role Overview
The IT Risk Manager is responsible for identifying, assessing, and managing technology-related risks across the organization. This role plays a critical part in ensuring regulatory compliance, cyber resilience, and operational stability within a highly regulated insurance environment.
Key Responsibilities
- Develop and maintain the IT Risk Management framework aligned with enterprise risk strategy.
- Identify and assess risks related to cybersecurity, data privacy, system availability, cloud platforms, and third-party vendors.
- Conduct IT risk assessments, control testing, and remediation tracking.
- Partner with IT, Information Security, Compliance, Internal Audit, and Business teams.
- Monitor and report IT risk metrics, incidents, and Key Risk Indicators (KRIs).
- Ensure compliance with regulatory requirements (Insurance Commission, BSP, ISO 27001, NIST, COBIT).
- Support regulatory reviews, internal audits, and risk committee reporting.
- Oversee vendor and third-party technology risk assessments.
- Support business continuity and disaster recovery planning and testing.
Qualifications & Experience
- Bachelor’s degree in IT, Computer Science, Risk Management, or a related field.
- 5–8 years’ experience in IT Risk, Technology Audit, Information Security, GRC, or IT Governance.
- Experience in insurance or financial services is strongly preferred.
- Strong knowledge of IT risk and control frameworks (COBIT, ITIL, ISO 27001, NIST).
- Professional certifications are an advantage: CISA, CRISC, CISSP, ISO 27001.
Key Skills & Competencies
- Strong risk assessment and analytical skills.
- Ability to translate technical risks into business impact.
- Excellent stakeholder management and communication skills.
- High attention to detail and strong documentation capability.
- Proactive, structured, and compliance-focused mindset.
Work Setup
- Hybrid role based in BGC, Taguig.
Mandatory Questions to answer:
- Can you describe your approach to identifying, assessing, and prioritizing IT and cyber risks in an insurance environment?
- Share an example of a significant technology or cybersecurity risk you identified and how you drove remediation.
- How do you ensure compliance with Insurance Commission and other regulatory requirements while supporting business needs?
- What is your experience managing third-party or vendor technology risk?
- How do you communicate complex IT risks to senior management or risk committees?
