Cybersecurity Engineer (GRC with AI)

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of GovTech, is looking for a Cybersecurity Engineer focused on governance, risk and compliance (GRC) with AI. The role combines security policy work, system security plan (SSP) review and governance oversight with AI-assisted automation, and sits within the CISO Office.

Key responsibilities

• Design and operate AI-assisted automation for SSP review, evidence classification, control mapping, compliance monitoring and security-posture reporting, defining human review points and validating automated outputs.
• Write, review and maintain practical security policies, standards and implementation guidance that product and engineering teams can apply.
• Own and improve the governance and compliance monitoring approach, including what good security control implementation looks like for in-scope products.
• Strengthen SSP verification by turning broad clauses into testable control statements and evidence expectations.
• Coordinate ICT risk management: identification, treatment tracking, escalation, acceptance and closure, with clear ownership and due dates.
• Maintain security posture reporting and the CISO dashboard, highlighting gaps, trends and overdue actions.
• Set timelines and evidence requirements for audit follow-up, compliance reviews and other governance activities.
• Support rollout of policies for AI-assisted coding, sensitive data handling, SaaS usage, MCP integrations, logging and emerging technology risks.
• Work with security and engineering teams to find opportunities for compliance monitoring, workflow automation and agent-assisted evidence review while keeping human judgement.
• Run governance forums with product teams and stakeholders, record decisions and exceptions, and maintain reusable guidance, control interpretations and lessons learned.
• Advise CISO leadership on control gaps, resource constraints, residual risk and remediation priorities.

Required profile

• Technical security experience in cloud, application, infrastructure, platform, DevSecOps, security architecture or engineering, combined with governance, risk or compliance experience.
• Strong understanding of technical controls in practice: IAM, logging and monitoring, vulnerability management, secure software delivery, cloud security and data protection.
• Ability to write clear, enforceable control requirements and guidance for technical and non-technical audiences.
• Experience coordinating reviews across products or business units, and comfort working with cloud, SaaS, software delivery and AI-related risks.
• Experience with System Security Plans, threat modelling, AI governance, DevSecOps or automated compliance monitoring is advantageous.
• Strong stakeholder management, facilitation and written communication skills.

Required skills

• Security frameworks such as ISO 27001, NIST CSF, NIST SP 800-53, CSA CCM or equivalent.
• Governance tooling, GRC platforms, evidence repositories, dashboards and workflow automation.
• Certifications such as CISSP, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor are useful but not required.

What we offer

• A wholly-owned subsidiary of GovTech.
• A learning culture with growth and learning encouraged.
• Contract staff enjoy the same benefits as permanent employees.