🌍 Remote

Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines.

We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region.

7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors.

Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries.

If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us.

Southeast Asia’s fintech moment starts here.

About the role

You’ll build one ISMS framework for the whole Salmon Group, so every new regulation, licence, entity or market extends it instead of starting a new compliance project.

What you’ll do

Run the core GRC processes yourself while leading a GRC Engineer and growing the function. You report to the Group CISO.

Work with the Bank CISO, the Bank IS governance team, SOC, AppSec, IT, Risk, Compliance and Legal to apply one set of controls across every Group entity. BSP rules are one input to the framework, not its boundary.

Keep ISO/IEC 27001:2022 certification and PCI DSS v4.0.1 compliance as outputs of the common framework, and act as the main contact for the certification body and the QSA.

What you’ll own

Own the common controls framework: a single control catalogue with named owners, mapped to ISO/IEC 27001, PCI DSS, BSP regulations and the Data Privacy Act. It includes entity and jurisdiction overlays and standard risk and control matrices (RCMs).

Track changes in regulations and standards, and map each new obligation to an existing control or to a gap with an owner and a date.

Define how a new entity, licence, product or market joins the framework, and review new initiatives early for security and compliance impact.

Run information security risk management: methodology, risk register, annual assessment, treatment plans and risk acceptance. Own the policy lifecycle, an exception process with expiry dates, and the third-party security risk methodology.

Define how controls are tested and what counts as evidence. Automate control checks towards continuous monitoring, and select and implement a GRC platform.

Lead internal audits, external audits and regulatory examinations, and track findings to closure. Own responses to partner and client security due diligence.

Run the security and risk committees, report on risks and compliance status to the Group CISO and management, and brief and train managers and risk owners. Formalise the security services the Group provides to each entity.

What makes you a strong fit

6+ years in information security GRC, including 2+ years leading a GRC function or programme

A track record of building or scaling a GRC programme, ideally around a common controls framework and RCMs mapped to several standards

Hands-on experience taking an ISO/IEC 27001 ISMS through certification and surveillance audits

Practical PCI DSS experience, ideally v4.0.1 in a payments or service provider environment

Experience in regulated financial services (banking, payments or lending), including designing control testing and working with auditors and regulators on findings

Working knowledge of ISO/IEC 27005 or NIST SP 800-30, clear writing for senior management, and daily use of AI tools to build your own automations with AI-assisted coding

What we offer

Ownership and flexibility

Fully remote work

Company-provided tools and equipment

Health and time off

Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits

Access to an internal mental health support specialist

22 vacation days, Philippine public holidays, and 15 sick days

Growth and team experience

Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications