🌍 Remote
Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines.
We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region.
7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors.
Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries.
If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us.
Southeast Asia’s fintech moment starts here.
About the role:
You’ll build one ISMS framework for the whole Salmon Group, so every new regulation, licence, entity or market extends it instead of starting a new compliance project.
What you’ll do:
Run the core GRC processes yourself while leading a GRC Engineer and growing the function. You report to the Group CISO.
Work with the Bank CISO, the Bank IS governance team, SOC, AppSec, IT, Risk, Compliance and Legal to apply one set of controls across every Group entity. BSP rules are one input to the framework, not its boundary.
Keep ISO/IEC 27001:2022 certification and PCI DSS v4.0.1 compliance as outputs of the common framework, and act as the main contact for the certification body and the QSA.
What you’ll own:
Own the common controls framework: a single control catalogue with named owners, mapped to ISO/IEC 27001, PCI DSS, BSP regulations and the Data Privacy Act. It includes entity and jurisdiction overlays and standard risk and control matrices (RCMs).
Track changes in regulations and standards, and map each new obligation to an existing control or to a gap with an owner and a date.
Define how a new entity, licence, product or market joins the framework, and review new initiatives early for security and compliance impact.
Run information security risk management: methodology, risk register, annual assessment, treatment plans and risk acceptance. Own the policy lifecycle, an exception process with expiry dates, and the third-party security risk methodology.
Define how controls are tested and what counts as evidence. Automate control checks towards continuous monitoring, and select and implement a GRC platform.
Lead internal audits, external audits and regulatory examinations, and track findings to closure. Own responses to partner and client security due diligence.
Run the security and risk committees, report on risks and compliance status to the Group CISO and management, and brief and train managers and risk owners. Formalise the security services the Group provides to each entity.
What makes you a strong fit:
6+ years in information security GRC, including 2+ years leading a GRC function or programme
A track record of building or scaling a GRC programme, ideally around a common controls framework and RCMs mapped to several standards
Hands-on experience taking an ISO/IEC 27001 ISMS through certification and surveillance audits
Practical PCI DSS experience, ideally v4.0.1 in a payments or service provider environment
Experience in regulated financial services (banking, payments or lending), including designing control testing and working with auditors and regulators on findings
Working knowledge of ISO/IEC 27005 or NIST SP 800-30, clear writing for senior management, and daily use of AI tools to build your own automations with AI-assisted coding
What we offer:
Ownership and flexibility
Fully remote work
Company-provided tools and equipment
Health and time off
Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits
Access to an internal mental health support specialist
22 vacation days, Philippine public holidays, and 15 sick days
Growth and team experience
Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications
Company-sponsored trips to Manila to meet and work with your team in person
High-performing teams can earn a dedicated beach house week in Southeast Asia
We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.
Skills Required
- Strong practical experience in information security risk management, including inherent and residual risk, risk treatment, acceptance, control effectiveness, and risk appetite
- Technical depth to assess controls across IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development
- Hands-on experience reviewing or testing security controls and evaluating control effectiveness
- Working knowledge of ISO 27001 and information security management systems
- Ability to translate complex risk and control information into concise management reporting
- Experience working with GRC platforms, structured risk and control registers, and evidence management
What We Do
Salmon Group Ltd is a financial technology company serving Filipino consumers with modern, inclusive financial services. Its platform combines technology, product design, security, data analytics and customer care to make finance easier to access. Salmon offers consumer-focused products including short-term loans and digital banking services, with the broader mission of improving convenience, affordability and financial inclusion while operating securely around the clock.
.png){kind=logo}
