Engineer II, Cybersecurity Governance, Assurance & Data Protection

About the role

The Engineer II will join Circles’ Cyber Governance team in Singapore, reporting to the Director of Cyber Governance, Assurance & Data Protection. The role focuses on developing and operationalising cybersecurity frameworks, assurance activities and data‑protection programmes across the Group’s SaaS telco platforms.

Key responsibilities

• Develop, mature and operationalise cybersecurity framework, policies, procedures, guidelines and baseline standards.
• Embed cybersecurity best practices into new initiatives and evaluate security impact of changes.
• Identify, risk‑assess and drive adoption of administrative, technical and procedural measures to safeguard information assets.
• Ensure protection of organisational crown jewels in line with ISO 27701, PCI‑DSS, PDPA, GDPR and other regulations.
• Lead internal risk assessments, third‑party due‑diligence reviews, audit‑readiness activities and timely remediation of gaps.
• Support roadmap to maintain ISO 27001, DPTM, APEC CBPR and achieve SOC 2 compliance.
• Develop and enhance data‑privacy and protection frameworks, conduct privacy impact assessments and manage records of processing activities.
• Drive cybersecurity and privacy awareness programmes, create training curricula and promote a security‑first culture.
• Guide responsible AI adoption and provide advisory services on information security and privacy matters.

Required profile

• Degree in Information Technology, Cyber Security or a comparable qualification.
• 3+ years of professional experience in audit, assurance, governance or management consulting.
• Strong understanding of cybersecurity, data governance and assurance for SaaS‑based telco platforms.
• Excellent written and oral communication skills with the ability to engage stakeholders at multiple levels.
• Experience in Big 4 or Tier‑2 consulting firms, telco industry, cloud security, DevSecOps, micro‑services or container security is a plus.
• Familiarity with standards such as ISO 27001, ISO 27701, NIST, COBIT, PCI‑DSS, MTCS.
• Knowledge of global and regional data‑privacy regulations (GDPR, PDPA, PDPO).
• Commitment to continuous learning and relevant certifications (e.g., CRISC, CISA, CISSP, CDPSE).

Required skills

• Cloud infrastructure and security
• DevSecOps
• Micro‑services architecture
• Container security
• ISO 27001, ISO 27701, NIST, COBIT, PCI‑DSS, MTCS
• GDPR, PDPA, PDPO compliance