Cybersecurity Consultant - Managed Agencies

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of the Government Technology Agency (GovTech), is hiring a Cybersecurity Consultant for one of its government agency clients. You will work closely with application and infrastructure teams so that business needs are met, projects are delivered on time and within budget, and compliance is achieved within acceptable risk levels. You will also support security operations and incident management.

Key responsibilities

• Security governance and compliance: support the ACISO in maintaining an overview of ICT security design, implementation and operations, help ensure compliance with IM8 requirements and agency policies, and contribute to the annual review of security metrics and the risk and control programme.
• IT governance and IM8 compliance: support control validations for projects and day-to-day controls across on-premises and cloud environments, and take part in Change Advisory Board (CAB) forums as an IT and security governance representative.
• Risk management: support gap analyses of the agency's ICT security posture and maturity, and maintain the Security Risk Register, including approved waivers, risk acceptances and corrective action plans.
• Policies, standards and guidelines: support the review and update of ICT security policies using frameworks such as NIST, ISO, OWASP and PDPA.
• Security controls and patch governance: monitor and validate controls such as access management, patching, hardening, network connectivity, privileged access management and event logging, and help drive patch governance to reduce overdue patches.
• Threat and incident management: monitor for security incidents and support their investigation and management.
• Third-party and vendor governance: oversee third-party vendors, staff and contractors for IM8 compliance.
• Reporting and metrics: help prepare the monthly Technology and Security Governance report, IT Governance Report and security scorecard.
• Security awareness: help coordinate and deliver ICT security awareness and education programmes for users, IT officers and third parties.

Required profile

• Proven experience in IT security management focused on governance, risk and compliance.
• Strong analytical and problem-solving skills, with the ability to explain complex security and compliance issues clearly.
• Experience securing SaaS products and cloud security is preferred.

Required skills

• In-depth knowledge of security governance frameworks, risk management methodologies and compliance requirements.
• Familiarity with standards such as ISO 27001, GDPR and NIST.
• Certifications such as CISSP, CISM, CRISC or CGEIT are a plus.

The remuneration package depends on qualifications and experience. Only shortlisted candidates will be contacted.