IT Security Governance & Assurance Analyst

About the role

BCS, a wholly owned subsidiary of Network for Electronic Transfers (NETS) and part of the NETS Group, manages and operates clearing and payment infrastructure for the Singapore Automated Clearing House, including FAST, IBG, CTS, and services for PayNow and SGQR. The IT Security GRC unit drives cybersecurity governance, oversees risk assessments, manages audits and monitors security compliance. The IT Security GRC Analyst reports to the Security GRC Lead and acts as a subject matter expert in cybersecurity technologies and governance, overseeing compliance with IT Security policies and standards.

Key responsibilities

• Governance and compliance: develop, implement and maintain security policies, procedures and standards aligned with ISO 27001, NIST, CIS and other best practices; ensure compliance with regulatory requirements such as MAS TRMG and CCoP; assist in internal audits and security assessments; support third-party risk assessments and vendor security compliance.
• Risk management: conduct risk assessments, identify threats and vulnerabilities, and develop mitigation strategies; maintain a security risk register and track risk treatment plans; monitor emerging threats and help with business continuity and disaster recovery planning for security risks.
• Security awareness and training: develop and deliver security awareness training for employees and advise stakeholders on security best practices.

Required profile

• Bachelor's degree in Computer Science, Computer Engineering, Information Security or a related field.
• At least 3 years in security governance, risk or compliance management, preferably in financial services or payment systems.
• Experience in a highly regulated environment is advantageous.
• Preferred certifications: CISSP, CRISC, CISA or another GRC-related certification.

Required skills

• Familiarity with MAS notices on technology risk management, cyber hygiene, outsourcing and the Cybersecurity Code of Practice is preferred.
• Good knowledge of frameworks such as the NIST Cybersecurity Framework.
• Strong problem-solving, analytical, communication and stakeholder management skills.