Cybersecurity Engineer (GRC Manager)

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of GovTech, is looking for a Cybersecurity Engineer (GRC Manager) in Singapore. The role leads governance, risk and compliance (GRC) for managed products and platforms, acts as second line of defence for ICT risk and controls, and owns security plan governance, ICT audit workflows, security policies and security education.

Key responsibilities

• GRC leadership: shape risk and compliance governance, partner with product teams to embed security and compliance, and act as second line of defence with independent challenge on risk and controls.
• Security plan governance: set templates, evidence expectations and quality benchmarks, review Security Plans, recommend approvals, and treat automation as an always-on audit by tracking KPIs such as coverage, cycle time and defect rates.
• ICT audit and evidence management: design audit workflows, maintain audit plans, control descriptions and evidence repositories, run thematic and product-level audits, coordinate with internal audit and report on audit status and key risks.
• Security policy ownership: author and maintain policies on sandbox usage, AI coding practices and SaaS usage, and turn them into practical guidance for product teams.
• Security education, training and awareness: lead SeTA, run phishing simulations, security newsletters and brown-bag sessions, and track KPIs.
• Change management: champion issue-tracking and collaboration tools as the main systems of record for audit and evidence, and influence senior stakeholders to adopt them.

Required profile

• At least 5 years of cybersecurity experience, preferably in a regulated or public-sector environment.
• Strong understanding of ICT governance, security controls and how product teams work (SDLC, agile, cloud/SaaS).
• Comfortable acting as second line of defence and working with first and third lines.
• Experience designing issue-tracking workflows, dashboards and policy documentation, and writing clear policies and standards.
• Experience in security awareness and training, including phishing simulations and newsletters; giving talks is a plus.
• Comfortable using automation and AI-enabled tools such as enterprise search platforms.
• Excellent stakeholder management, negotiation and change-leading skills.

What we offer

• A wholly-owned subsidiary of GovTech.
• A learning culture with opportunities to grow and learn.
• Contract staff enjoy the same benefits as permanent employees.