Job Summary

The IT Security Lead manages end-to-end security governance, compliance, and operations for mission-critical systems, collaborating with cross-functional teams and external auditors to ensure adherence to government security policies.

Responsibilities

Day 1 – Project / Implementation Security

• Define and implement system security architecture aligned with Singapore Government policies
• Review application, middleware, infrastructure, and platform designs for security compliance
• Conduct threat modeling and risk assessments, mapping risks to mitigating controls
• Translate policy requirements into actionable technical controls across technology stacks
• Ensure compliance with IM8, Whole-of-Government security requirements, and PDPA where applicable
• Establish and oversee cybersecurity governance across infrastructure, application, and project teams
• Prepare and maintain documentation including Security Risk Assessments, Vulnerability Assessments, Penetration Testing reports, and security hardening baselines
• Partner with software teams to enforce secure coding standards and DevSecOps practices
• Integrate and govern SAST/DAST, dependency/SCA scanning, and container image scanning within CI/CD pipelines
• Review and triage security tool findings, driving remediation and risk acceptance decisions
• Provide guidance on API security, token/secret management, and secure service-to-service communication
• Plan, coordinate, and manage vulnerability and penetration testing engagements and vendors
• Track remediation progress to closure and document residual risks and risk acceptance
• Support security clearances and go-live certifications
• Review and approve OS, middleware, database, Kubernetes/container security, API gateway, WAF, rate-limiting, and authentication configurations

Day 2 – Operations / Production Security

• Lead security incident investigations, containment, and recovery efforts
• Perform root cause analysis and define corrective and preventive actions
• Coordinate with Government SOC and stakeholders; contribute to and refine incident response playbooks
• Communicate security incidents clearly to technical and non-technical audiences
• Oversee continuous vulnerability monitoring and posture management
• Track patch and configuration compliance across infrastructure, middleware, applications, and containers
• Provide risk assessments and compensating controls for deferred patches
• Review and tune alerts, detections, and dashboards in SIEM and related tools
• Ensure monitoring coverage for critical systems and high-value assets
• Support internal and external audits, evidence collection, and closure of audit findings
• Prepare and present security posture, metrics, and trend reports to management
• Maintain risk registers and mitigation plans with up-to-date security documentation
• Communicate security assessments and findings effectively to varied stakeholders
• Oversee and periodically review RBAC, MFA, Privileged Access Management, and joiner/mover/leaver processes
• Ensure least privilege access, segregation of duties, and periodic access recertifications
• Support incident response handling, log analysis, and activity reviews
• Drive continuous improvement across identify, protect, detect, respond, and recover functions

Required competencies and certifications

• Degree in Computer Science, Cybersecurity, Information Security, or equivalent
• 8–12 years of IT experience including at least 5 years as a Security Lead or Security Architect
• Proven experience in Singapore Government IT projects and IM8/government security compliance
• Hands-on experience with Kubernetes/Docker security, API security, Identity & Access Management (IAM), and security tools (SAST/DAST/SIEM) integrated with CI/CD

Preferred competencies and qualifications

• Certifications such as CISSP, CISM, CISA, CEH, GIAC (e.g., GSEC, GCIA, GCIH, GCSA)
• AWS or Azure Security certifications

5 day week @ AMK area

Maestro HR
damien lee tian hong
R1106726
16C8462