Governance, Risk and Compliance Analyst

About the role

With a minimum of two years of relevant experience in governance, risk, compliance, internal audit, control testing, or security governance, you will help XieTech see its obligations and follow through on them. You will work with security, privacy, finance, and operations to keep policies, risk records, and evidence accurate enough for decisions and reviews.

What you'll do

• Maintain the risk register, control inventory, and obligation tracker with clear owners and due dates
• Map policies and procedures to the controls teams actually use
• Collect and review evidence for control operation, audits, and management reviews
• Support risk assessments for products, vendors, and internal processes and record the result
• Track findings and corrective actions through ownership, status, and closure
• Draft practical updates to policies, standards, and registers so they stay usable
• Prepare concise status updates for leaders on open risks, overdue actions, and evidence gaps

What you'll bring

• Minimum of 2 years of relevant experience in governance, risk, compliance, internal audit, control testing, or security governance
• Working knowledge of risk assessment, control design, and evidence collection
• Careful documentation of owners, dates, status, and supporting records
• Ability to read a policy or requirement and describe the control that meets it
• Clear writing for both specialists and leaders who need a short status
• Discretion when handling control gaps, incidents, and confidential business information
• Collaborative follow-through in a remote, early-stage technology team

Nice to have

• Familiarity with ISO 27001, SOC 2, NIST, or a similar control framework
• Experience supporting technology, cybersecurity, privacy, or vendor-risk reviews
• Familiarity with Philippine regulatory, data-privacy, or corporate-governance requirements
• Relevant audit, risk, compliance, or security certification or training