Brunei , Philippines jobs in POEA

Information Security & IT Operations Lead

T-Mate | Remote, Philippines

Build a security program from zero. No legacy systems to untangle, no old habits to break. Just a clean slate and a real mandate to protect healthcare data for a growing, remote-first team.

About T-Mate

We're a remote-first company based in Waco, Texas, connecting US home-care agencies with skilled Filipino professionals. We're also building an AI-first contact center for the future of remote healthcare. Our teams work inside client systems every day, often handling protected health information (PHI), so security isn't optional. It's core to how we operate.

The Role

You'll be our first dedicated Information Security & IT Operations hire. An external compliance partner guides our HIPAA and SOC 2 Type II programs and tells us what controls we need. Your job is to build those controls, run them day to day, fix what breaks, and prove they're working.

In your first year, you'll help us:

• Earn a SOC 2 Type II report
• Respond quickly and confidently to client security questionnaires
• Get real visibility into whether remote agents' devices meet our security standards

What You'll Own

Manage identity, access, groups, Context-Aware Access, DLP, Vault, and endpoint policies. Make sure security rules are actually enforced, not just written down.

Remote & BYOD Security - You'll secure a fully remote workforce, including devices employees own themselves. You'll run our enterprise browser or workspace-enclave tool, build controls for devices with local admin access, and catch the ones that fall out of compliance. We need someone who's done this before, not someone learning on the job.

Access Management - Handle the full lifecycle (joiners, movers, leavers) across Google Workspace, client CRMs, phone systems, and internal platforms. Apply least-privilege access, run quarterly access reviews, and offboard people within four hours.

Compliance & Audits - Work directly with our compliance partner on HIPAA and SOC 2. Gather evidence, implement controls, close audit findings, and keep documentation that proves everything is working.

Vendor Risk - Maintain our BAA and subprocessor records. Vet new vendors before they touch PHI. Support security reviews for any tool that wants access to our systems.

Incident Response & Training - Lead the response when something goes wrong. Investigate, document, fix it, and build practical playbooks for next time. Run security awareness training that people actually remember.

Client Questionnaires - Be our go-to person when clients ask about our security setup. Write clear, accurate answers they can trust.

What You Bring

• 4+ years in IT operations and information security, hands-on, not just oversight
• Strong Google Workspace admin experience, well beyond basic user setup
• Hands-on work with Context-Aware Access, DLP rules, endpoint policies, or device posture controls
• Experience supporting a SOC 2, ISO 27001, or HIPAA program (evidence gathering, control implementation, closing findings)
• Experience supporting a remote workforce, ideally in a BPO, offshore, or distributed team
• Strong written English. You should be able to draft a client security questionnaire that needs little to no editing
• Good judgment. You'll make security calls on your own and own the outcome

Nice to have:

• Working knowledge of the HIPAA Security Rule
• Familiarity with the Philippine Data Privacy Act, especially around workforce monitoring
• Experience with a compliance automation platform
• CISSP, CISA, CISM, or Google Workspace Administrator certification
• Background in BPO, healthcare, or tech

The Setup

• Fully remote, open to candidates anywhere in the Philippines
• Some overlap with US Pacific Time hours required, schedule to be worked out with you
• Company-issued laptop provided. No personal device needed
• Offer subject to NBI clearance and reference checks (standard for roles with privileged access)

Why This Role

You won't be maintaining someone else's system. You'll build our security operations, endpoint standards, access controls, and incident response process from scratch, and shape how we protect sensitive healthcare data as we grow.

Pay: Php139,000.00 - Php160,000.00 per month

Benefits:

• Work from home

Application Question(s):

• For us to process your application accordingly, please answer this question: Can you share an example of a security rule you put in place that turned out to be weak or ineffective? How did you resolve the issue?

Work Location: Remote