Information Security Specialist

Position Overview

The Information Security Specialist will support MicroSourcing's information security program through audit and

compliance activities, security operations, training and awareness, risk management, and security control

implementation. The role will help ensure that information security controls, policies, and processes are effectively

implemented, monitored, and continuously improved in alignment with applicable standards, regulatory

requirements, and client commitments.

Recruitment Summary

MicroSourcing is seeking an Information Security Specialist to support our information security program across

audits, security operations, training and awareness, risk management, and compliance initiatives. The successful

candidate will work closely with internal teams, auditors, and stakeholders to maintain effective security controls,

support regulatory and client requirements, and drive continuous improvement in our cybersecurity posture.

Key Responsibilities:

Audit and Compliance

• Support internal and external audits, including ISO/IEC 27001, SOC 2, PCI DSS, and client security
• assessments.
• Coordinate the collection, review, and validation of audit evidence.
• Track audit findings, corrective actions, and remediation activities.
• Participate in audit walkthroughs, control assessments, and compliance reviews.
• Maintain audit documentation, evidence repositories, and compliance records.

Information Security Operations

• Assist in day-to-day information security operations and monitoring activities.
• Support implementation, monitoring, and review of security controls.
• Coordinate with IT, Infrastructure, HR, and Operations teams on security issues.
• Assist with vulnerability management, security assessments, and remediation tracking.
• Coordinate with IT and relevant stakeholders to investigate security events and ensure timely remediation of identified issues.
• Generate and maintain operational reports, dashboards, and metrics related to security tools, vulnerabilities, alerts, and remediation status.
• Assist with onboarding, tuning, and periodic review of security tools, including policies, detection rules, exclusions, and access permissions.
• Support the configuration, administration, health monitoring, and maintenance of security-related tools and platforms.
• Review, validate, prioritize, and escalate security alerts and identified vulnerabilities based on severity and business impact.
• Perform, coordinate, and document vulnerability scans and security assessments across applicable systems, endpoints, applications, and infrastructure.
• Monitor and review alerts, dashboards, and reports from security tools, including EDR/XDR, SIEM, vulnerability scanners, email security, and other security platforms.
• Support incident management documentation, escalation, and follow-up.

Training and Awareness

• Assist in planning and delivering information security awareness programs.
• Support onboarding, refresher training, and employee awareness sessions.
• Develop security awareness materials and communication campaigns.
• Coordinate phishing simulation exercises and track training completion.
• Promote a strong security culture across the organization.

Risk Management and Security Assessments

• Assist with information security risk assessments and control evaluations.
• Support third-party and vendor security assessments and questionnaire reviews.
• Maintain risk registers, action plans, and remediation trackers.
• Identify potential security risks and escalate issues appropriately.
• Assist in reviewing policies, procedures, and control effectiveness.
• Policy, Documentation and Governance
• Assist in developing and reviewing information security policies and procedures.
• Support the implementation and maintenance of the ISMS.
• Maintain security documentation in accordance with document control requirements.
• Prepare security reports, metrics, and management updates.
• Support continuous improvement initiatives.

Stakeholder and Audit Coordination

• Coordinate with internal departments, clients, auditors, and service providers.
• Support audit scheduling, meeting coordination, and follow-up actions.
• Assist in responding to client security questionnaires and compliance requests.
• Communicate security requirements and follow up on deliverables.
• Perform other information security-related tasks as assigned.

Required Qualifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Security, or a
• related field.
• At least 2–4 years of experience in information security, IT audit, GRC, cybersecurity operations, or a related field.
• Knowledge of ISO/IEC 27001, SOC 2, PCI DSS, and NIST Cybersecurity Framework.
• Experience supporting audits, compliance assessments, or security control reviews.
• Understanding of risk management, security policies, and information security principles.
• Strong documentation, analytical, organizational, and communication skills.
• Ability to work independently and collaborate with cross-functional teams.

Preferred Qualifications

• ISO/IEC 27001 Internal Auditor or Lead Auditor training/certification.
• Experience with security awareness and phishing simulation programs.
• Familiarity with Vanta, OneTrust, RSA Archer, or similar GRC platforms, as well as EDR/XDR, SIEM,
• vulnerability scanning, and security monitoring tools.
• Knowledge of vulnerability management, endpoint security, and security monitoring.
• Experience in a BPO, IT services, or managed services environment.
• Familiarity with the Philippine Data Privacy Act.
• Relevant certifications such as ISC2 CC, CompTIA Security+, or equivalent.

Core Competencies

• Information Security: Understanding of security principles, controls, and best practices.
• Audit and Compliance Ability: to support audits and maintain reliable evidence.
• Risk Management: Ability to identify, document, and track security risks.
• Communication: Effective collaboration with stakeholders and auditors.
• Analytical Thinking: Ability to analyze findings and identify control gaps.
• Documentation: Accurate and organized security documentation.
• Continuous Improvement: Proactively identifying opportunities to improve security processes.

Key Performance Indicators (KPIs)

• Timely completion of assigned audit evidence and action items.
• Timely tracking and follow-up of assigned remediation activities.
• Completion of assigned security reviews and monitoring tasks.
• Training completion rates and timely delivery of awareness activities.
• Timely completion and documentation of assigned risk assessments.
• Accuracy and timely maintenance of security documentation.
• Responsiveness to stakeholder requests and assigned actions.

Work Environment

• Full-time position supporting the organization's information security program.
• Regular collaboration with internal departments, auditors, clients, and security partners.
• Participation in audit walkthroughs, security assessments, training sessions, and compliance activities.
• Ability to manage multiple information security initiatives and priorities simultaneously.