GRC Analyst

The GRC Analyst supports the integrity and currency of MyPass's third-party provider, risk, policy, and CAPA registers, ensuring all entries are reviewed, updated, or progressed to closure on schedule with appropriate evidence. The role supports the Senior Corporate Services Manager's ISMS ownership and audit obligations, and provides broader coordination support across compliance platforms, training campaigns, system access, Google Workspace guidance, and process documentation.

Responsibilities

Monitor the policy lifecycle to ensure review deadlines are met; Coordinate the policy review and approval process across all business areas; Publish approved policies in Confluence and Drata; Coordinate the timely review of risks within Drata; Monitor and report on Drata control readiness; Create and manage Jira tickets for control issues requiring remediation; Maintain the third-party provider register and coordinate vendor due diligence; Own the CAPA register within QT9 and expedite evidence collection; Coordinate the rollout of KnowBe4 training campaigns; Undertake system access reviews; Provide guidance on Google Workspace functionality; Document GRC standard operating procedures in Confluence; Support external audit processes including ISO 27001 certification and surveillance audits

Requirements

Demonstrated experience in GRC, risk, or compliance roles within an organisation managing information security or regulatory compliance obligations; Proven ability to manage and coordinate multiple compliance registers simultaneously, including policy, risk, and corrective action registers; Demonstrated experience working within a GRC platform such as Drata or equivalent, including control monitoring, evidence management, and compliance reporting; Demonstrated experience supporting internal or external audit programmes, including evidence preparation and coordination; Experience managing or coordinating corrective action or CAPA workflows through to closure; Proven ability to coordinate across multiple business areas to meet compliance deadlines without direct authority over stakeholders; Demonstrated experience expediting evidence or actions from stakeholders and escalating appropriately where timelines are at risk; Experience using Jira or equivalent ticketing tools for issue tracking and remediation coordination; Experience documenting standard operating procedures in a platform such as Confluence; Demonstrated critical thinking and independent problem-solving in past roles, with evidence of identifying and resolving issues without being directed to do so; High attention to detail, particularly in reviewing and preparing compliance evidence

Nice to have

Working knowledge of Google Workspace, including shared drive structure and administration (highly desirable)

Benefits

Accessible and friendly office in Cebu IT Park; Celebrate You - Anniversary gifts as early as your first work anniversary; Be Healthy - Wellbeing policy and company-sponsored Healthcare Insurance worth PHP 110,000.00; Work-Life Balance - 16 Paid Time Offs and 8 Compensatory Time Offs; Fuel Your Growth Journey - learning and development opportunities; Get Rewarded and Recognized - Monthly Value Awards; Be Comfortable - Casual Friday every day; We Love to Have Fun - Team outings, weekly lunches, team events; Generous Employee Referral Program - Rewards for referring top talent