Deputy Director, Cyber Analysis & Operations

About the role

The Deputy Director of Cybersecurity Analysis and Operations leads the strategic and operational direction of the Maritime Cyber Assurance and Operations Centre (MCAOC), which provides 24/7 protection of MPA's digital systems. The role drives cyber defence for port operations, vessels, onshore IT/OT systems and national maritime resilience, working with industry, government agencies and international partners against evolving threats.

Key responsibilities

• Lead 24/7 MCAOC operations, including real-time threat monitoring, anomaly detection, incident response and recovery for maritime IT/OT environments.
• Develop and run the SOC strategy, combining threat intelligence, red teaming, threat hunting and AI-driven analytics.
• Set up cyber incident response frameworks, playbooks and sectoral exercises such as TTX simulations for maritime critical information infrastructure.
• Align IT/OT cybersecurity with the Integrated Operations Centre, enterprise architecture and CII owners for holistic risk management.
• Drive automation, SOAR, SIEM/EDR enhancements and data linkages for early warning of threats to navigational safety and business continuity.
• Lead investigations, vulnerability assessments and remediation, ensuring compliance with Singapore cybersecurity regulations.
• Deliver executive dashboards and reports on SOC metrics (MTTD/MTTR), threat trends and resilience posture to the CISO and leadership.
• Foster partnerships for information sharing and build and mentor a high-performing SOC team, including MariOT testbed training.

Required profile

• Background in Cybersecurity, Computer Science or a related field.
• 12-15+ years in cybersecurity, with 7+ years leading SOC operations.
• Deep expertise in IT/OT convergence, CII protection, red teaming and incident management.
• Experience in Singapore government or critical infrastructure cybersecurity.
• Strong executive communication for board-level reporting and crisis leadership.

Required skills

• SIEM, EDR, NDR, SOAR and threat intelligence platforms
• Certifications such as CISSP, CISM, GIAC (GCIH/GCIA) preferred

Successful candidates receive a 2-year contract initially, with possible extension or permanent appointment.