GRC Specialist (Governance, Risk, and Compliance)

BCM One

About The Position

BCM One is hiring a GRC Specialist to join its global compliance team. The role bridges Information Security Governance, Risk & Compliance (GRC) and IT Service Management (ITSM), strengthening global IT operations and the company’s compliance posture. The specialist will work hands-on with security, compliance, and service management teams to design, implement, and operate security controls aligned with internal standards, industry regulations, and contractual requirements. Reporting to the Global Manager of Info Sec & GRC, the role leads monitoring, assessment, design, implementation, and maintenance of security processes aligned with GRC frameworks, while supporting operational excellence, audit readiness, and risk mitigation across global teams. The preferred work location is the National Capital Region, though remote candidates are also considered. Candidates must live in and be authorized to work in the Philippines; relocation and sponsorship are not available. Core working hours are typically 8 p.m. to 5 a.m. local time, with flexibility to support international teams. Travel is unlikely but may include fewer than five trips per year to international offices. BCM One is a telecom provider of NextGen Communications and Managed Services. Its family of brands includes SIP.US, SIPTRUNK, Flowroute, SkySwitch, and Pure IP. The company emphasizes teamwork, accountability, innovation, employee development, inclusion, and a world-class customer experience.

Requirements

At least 5 years of hands-on Security Governance, Risk & Compliance experience, including direct responsibility for leading the design, implementation, and ongoing operation of security controls.
Strong hands-on experience with SOC 2.
Knowledge of GRC frameworks such as ISO 27001, NIST 800-53, CIS Controls, and GDPR, with experience applying frameworks to security control implementation.
Proven experience managing audit preparation and evidence for internal and external audits.
Ability to identify, assess, and prioritize risks using risk-based thinking and sound judgment.
Skill in monitoring security and compliance performance through KPIs, SLAs, and OLAs.
Strong documentation, analytical, and organizational skills, with attention to detail.
Ability to manage multiple priorities and deadlines in a fast-paced, global environment.
Strong communication skills, including the ability to explain technical and compliance concepts to non-technical audiences.
Experience working cross-functionally with IT, security, compliance, and business teams to drive security control adoption across geographies.
Familiarity with ITIL processes, including incident, problem, change, request, and asset/configuration management.
Proactive mindset and commitment to integrity, confidentiality, and continuous learning.
Must live in and be authorized to work in the Philippines.

Nice To Haves

Experience with IT Service Management.
Systems administration experience.
Experience in regulated industries such as telecommunications, finance, or healthcare.

Responsibilities

Support the development, implementation, and maintenance of GRC frameworks, including ISO 27001, SOC 2, and GDPR.
Conduct risk assessments, design and validate security controls, monitor compliance, and evaluate third-party security.
Manage internal and external audits, including preparation, evidence collection, reporting, and remediation planning.
Partner with cross-functional teams to lead security control implementation and advise stakeholders on control adoption.
Maintain policies, procedures, and control documentation in accordance with global standards.
Collaborate with Privacy and Legal teams on data protection and facilitate privacy impact assessments.
Facilitate Business Impact Assessments and oversee Business Continuity testing and updates.
Monitor and report Security GRC metrics to identify risks and improvement opportunities.
Support change management to maintain security and compliance while minimizing disruption.
Coordinate IT, Security, and Compliance teams to align service delivery with regulatory requirements.
Deliver security training and awareness programs, including phishing simulations and compliance education.
Recommend and implement process improvements to reduce risk and enhance operational efficiency.

Benefits

Competitive industry salaries with annual reviews.
Health insurance (HMO with two free dependents).
Generous paid time off.
Company retirement plan.
13th month pay.
Employee of the Quarter program with a monetary award.
Employee of the Year award that includes a 7-day Caribbean vacation package.
Regional team-building gatherings.
Training, professional development, and career growth opportunities.
BCM One Gives Back Program and an Emergency Fund for team members experiencing difficult times.