GRC Application Security Specialist (2-Year Contract)

About the role

This is a 2-year contract for a Governance, Risk and Compliance (GRC) and Application Security Specialist. The role builds a strong culture of technology and cybersecurity risk governance across the organisation, covering policy oversight, compliance monitoring, secure coding guidance and vulnerability management.

Key responsibilities

• Governance, Risk and Compliance: promote a culture of technology risk governance, advise internal stakeholders on cybersecurity requirements (including MAS, GovTech and Cyber Security Agency of Singapore policies), review and establish ICT policies and process controls, and run regular compliance checks
• Track technology projects and initiatives against compliance requirements, including Key Risk Indicators and Control Self-Assessment, and monitor incident reporting and corrective measures
• Take part in consultations and gap analyses against new or revised regulations, assess waivers for deviations and develop risk treatment strategies
• Organise risk forums, coordinate and facilitate IT and cybersecurity audits, track remediation plans and follow up with stakeholders, project managers and application managers
• Establish secure coding, vulnerability management and incident response guidelines, act as subject matter expert for enterprise projects and integrate security tools and automated scans into DevOps pipelines
• Work with developers to find and fix vulnerabilities, track timely patching and promote secure coding practices
• Recommend process improvements, present management reports with data analysis and strengthen ICT risk training materials

Required profile

• At least 5 years of relevant experience in ICT cybersecurity, data security, audit management, GRC, or as a security engineer/architect
• Preferred: certifications in IT governance, IT audit, cyber or data security (e.g. CISSP, CISM, CISA)
• Preferred: knowledge of Instruction Manual 8 and the CSA Cybersecurity Code of Practice
• Preferred: experience in penetration testing, secure code review, static/dynamic and manual source code review, and web application scanning tools
• Preferred: experience in data visualisation and analytics, and reporting dashboards in JIRA