IT Security Governance and Assurance Lead

About the role

BCS, a wholly owned subsidiary of Network for Electronic Transfers (NETS) and part of the NETS Group, manages and operates clearing and payment infrastructure such as FAST, IBG, CTS, PayNow and SGQR Central Repository. Its IT Security Team protects data and mitigates cyber threats in line with regulatory requirements. The Security Governance and Assurance (SGA) unit drives cybersecurity governance, oversees risk assessments, manages audits and monitors compliance. The SGA lead reports directly to the BCS CISO, acts as a subject matter expert in cybersecurity governance, manages a team of Security GRC specialists and oversees compliance with cyber risk policies and standards.

Key responsibilities

• Design, implement and update cybersecurity policies, standards, guidelines and processes, and recruit, train and retain security governance, risk and compliance specialists.
• Lead risk assessments, review security deviations and risk acceptance submissions, and recommend remediations; assess emerging threats and recommend controls.
• Drive vulnerability assessments, mitigation of findings and implementation of cybersecurity controls, and investigate breaches and vulnerabilities.
• Stay current with regulations such as the Cyber Security Act and MAS Notices, and monitor VAPT, red teaming and table-top exercises.
• Maintain the Risk Management framework, track security gaps and audit findings, and coordinate IT-security audits and remediation.
• Develop and report IT security metrics and KRIs to internal risk committees and external forums.

Required profile

• Bachelor's or Master's degree in Computer Science, Computer Engineering, Information Security or a related field.
• At least 10 years in IT governance, risk or compliance management, preferably in financial services or payment systems.
• Preferred certifications: CISM, CSSP, CGEIT, CISA, CRISC or similar GRC certification.

Required skills

• Knowledge of cybersecurity frameworks, regulatory and legal requirements and industry practices.
• Familiarity with MAS and CCOP regulations, COBIT, ITIL, the Personal Data Protection Act and the Payment Services Act.
• Understanding of secure hybrid cloud architectures, CI/CD and DevSecOps.
• Strong audit standards knowledge, stakeholder management and leadership skills.