Deputy/Manager, Transit Ticketing System & Governance (GRC)

About the role

The Transit Ticketing System is an integrated fare collection and contactless smart card payment system for public transport across Singapore, covering frontend devices (MRT/LRT fare gates, bus fare readers, top-up machines and apps) and backend servers, networks and applications. As Deputy/Manager of the Transit Ticketing System and Governance (GRC) officer, you act as operations lead supporting the system owner, helping maintain, enhance and govern the system so that commuter trust is maintained and service delivery is people-centred.

Key responsibilities

• Maintain oversight of the system's security, risk management and compliance, ensuring confidentiality, integrity and availability in line with regulatory and organisational governance requirements.
• Keep the governance framework effective by overseeing process, metrics, audit and risk reports from internal and external stakeholders, and by assessing commuter, operational and financial impacts to mitigate risk and minimise service disruption.
• Enforce cybersecurity and data protection policies aligned with government IM8 requirements and standards such as ISO 27001, NIST and PCI-DSS, and work with the technical cyber security team and contractors to monitor controls on IT infrastructure, cloud services, networks and applications.
• Establish KPIs on cybersecurity and data protection, review contractor reports and update them for senior management.
• Review the cybersecurity policy, support internal and external audits, maintain a register of information security and data protection risks and track mitigation plans.
• Manage cybersecurity and data protection incidents, including detection, analysis, containment, eradication and recovery, and coordinate incident response, business continuity and disaster recovery.
• Implement awareness programmes such as phishing simulations and tabletop exercises, and support staff training on cyber security, secure data handling and breach prevention.

Required profile

• Knowledge of computer science, engineering or information technology, and cyber security.
• Proven experience managing cyber security and data protection operations and incident management.
• Strong understanding of information security and data protection principles, ISO 27001, PDPA, PCI-DSS and cloud security standards.
• Strong incident response, communication, situational awareness and stakeholder management skills, and the ability to analyse complex problems and recommend practical solutions.