Senior Cybersecurity Operations Specialist

About the role

GovTech is the lead agency behind Singapore's Smart Nation initiatives and public sector digital transformation. Its Cyber Security Group (CSG) builds a safer, more secure digital government. As Security Operations Specialist within the Ministry CISO (MCISO) Office, you will be the lead architect of the Ministry's operational resilience, ensuring the Ministry Family spansning multiple agencies stays ready against cyber threats. You will standardise incident response, oversee comprehensive monitoring and drive advanced resiliency testing such as chaos testing.

Key responsibilities

• Standardise incident response: establish and maintain Ministry-wide Incident Response playbooks for scenarios such as ransomware, data exfiltration and cloud breaches; guide agencies during high and critical incidents; work with Agency CIOs and CISOs on command structures.
• Run advanced exercises: design and oversee Tabletop Exercises for system owners, SIROs, CISOs and CIOs, evaluate external vendors, and drive chaos testing across agencies.
• Build capability: assess the operational readiness of the Ministry Family and lead initiatives to close gaps in incident management.
• Centralise monitoring and asset visibility: get all Ministry systems onboarded to central monitoring, maintain an up-to-date IT asset inventory, and advise agencies with special systems (e.g. OT/ICS) on custom detection.
• Manage vulnerabilities and attack surface: set SOPs for vulnerability management across on-premises, cloud (GCC) and OT environments, ensure scanning tools are deployed and that patches are applied and effective.
• Educate stakeholders on response and business continuity planning and foster a mindset of assumed breach.

Required profile

• 8 to 10 years of experience in Cybersecurity Operations, SOC Management or Incident Response.
• Proven track record of leading or overseeing high-severity security incidents.
• Experience managing security operations across hybrid environments (on-premise, cloud and OT).
• Professional certifications such as GCIH, GCFA, CHFI or CISSP are highly desirable.
• Open to Singaporeans only.

Required skills

• Incident response, digital forensics and malware analysis.
• Threat intelligence and MITRE ATT&CK mapping.
• CVE and CVSS knowledge, and understanding of exploitation techniques.
• Proficiency in SIEM, SOAR, XDR and EDR.
• Monitoring and incident response in Government Commercial Cloud (GCC) and native cloud environments.