IT Security Specialist (Governance)

About the role

HDB, which provides affordable housing and a safe living environment, wants to be data-driven and evidence-based in its housing policies and service delivery. As an IT Security Specialist (Governance), you will strengthen the organisation's cybersecurity posture by designing, operationalising and governing a robust ICT governance framework across enterprise IT systems and programmes, covering policies, standards and controls.

Key responsibilities

• ICT Security Governance: set up the cybersecurity governance structure, update IT security policies, standards and procedures, manage compliance with Whole-of-Government ICT/SS security policies and the Government Instruction Manual, and administer the Third-Party Management Policy and Procedure.
• Cybersecurity Awareness Outreach: run the Cybersecurity Awareness Framework, including awareness talks, security advisories, phishing exercises and roadshows, and explore channels such as cyber range exercises, technical certification and gamification.
• Identity and Access Management: manage user accounts and privileged access, set up and maintain application access controls, and manage the lifecycle of digital certificates.
• Quality Audit and Security Reviews: act as an independent auditor reporting audit findings to management, and carry out regular security reviews and compliance checks on applications and infrastructure.
• Keep up with industry ICT security practices, emerging threats and vulnerabilities and recommend appropriate controls.

Required profile

• Strong background and interest in ICT security, information security, computer science, engineering (computing/telecommunications), cybersecurity and/or digital forensics, or equivalent.
• At least 2 years of direct, full-time ICT security work experience.
• Knowledge of information and cybersecurity risks, controls, vulnerability assessment and penetration testing, compliance and industry best practices.
• Preferably one or more IT security certifications such as CISSP, CRISC, CISM, CISA or CEH.

Required skills

• Added advantage: access control, telecom and network security, cloud security, security governance and risk management, software development security, cryptography, security architecture, incident response, business continuity and disaster recovery, and legal/regulatory compliance.
• Good to have: knowledge of IT controls frameworks such as IM8, COBIT and ISO 27001/2, and good command of written and spoken English.