GRC Lead

🌍 Remote
Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines.
We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region.
7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors.
Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries.
If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us.
Southeast Asia’s fintech moment starts here.

About the role:
You’ll build one ISMS framework for the whole Salmon Group, so every new regulation, licence, entity or market extends it instead of starting a new compliance project.

What you’ll do:

• Run the core GRC processes yourself while leading a GRC Engineer and growing the function. You report to the Group CISO.
• Work with the Bank CISO, the Bank IS governance team, SOC, AppSec, IT, Risk, Compliance and Legal to apply one set of controls across every Group entity. BSP rules are one input to the framework, not its boundary.
• Keep ISO/IEC 27001:2022 certification and PCI DSS v4.0.1 compliance as outputs of the common framework, and act as the main contact for the certification body and the QSA.

What you’ll own:

• Own the common controls framework: a single control catalogue with named owners, mapped to ISO/IEC 27001, PCI DSS, BSP regulations and the Data Privacy Act. It includes entity and jurisdiction overlays and standard risk and control matrices (RCMs).
• Track changes in regulations and standards, and map each new obligation to an existing control or to a gap with an owner and a date.
• Define how a new entity, licence, product or market joins the framework, and review new initiatives early for security and compliance impact.
• Run information security risk management: methodology, risk register, annual assessment, treatment plans and risk acceptance. Own the policy lifecycle, an exception process with expiry dates, and the third-party security risk methodology.
• Define how controls are tested and what counts as evidence. Automate control checks towards continuous monitoring, and select and implement a GRC platform.
• Lead internal audits, external audits and regulatory examinations, and track findings to closure. Own responses to partner and client security due diligence.
• Run the security and risk committees, report on risks and compliance status to the Group CISO and management, and brief and train managers and risk owners. Formalise the security services the Group provides to each entity.

What makes you a strong fit:

• 6+ years in information security GRC, including 2+ years leading a GRC function or programme
• A track record of building or scaling a GRC programme, ideally around a common controls framework and RCMs mapped to several standards
• Hands-on experience taking an ISO/IEC 27001 ISMS through certification and surveillance audits
• Practical PCI DSS experience, ideally v4.0.1 in a payments or service provider environment
• Experience in regulated financial services (banking, payments or lending), including designing control testing and working with auditors and regulators on findings
• Working knowledge of ISO/IEC 27005 or NIST SP 800-30, clear writing for senior management, and daily use of AI tools to build your own automations with AI-assisted coding

What we offer:
Ownership and flexibility

• Fully remote work
• Company-provided tools and equipment

Health and time off

• Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits
• Access to an internal mental health support specialist
• 22 vacation days, Philippine public holidays, and 15 sick days

Growth and team experience

• Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications
• Company-sponsored trips to Manila to meet and work with your team in person
• High-performing teams can earn a dedicated beach house week in Southeast Asia

We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.