Director, Cyber Security Governance, Risk and Assurance

About the role

Reporting to the Group Chief Information Security Officer, the Group Cyber Governance, Risk & Assurance Director is a senior Group-level leadership role accountable for setting, maintaining and enforcing Singtel Group's cyber security policies, standards and compliance posture. It owns the Group cyber policy framework, control standards and assurance mechanisms so that risks are identified, assessed, managed and reported across all Operating Companies and Associates.

Key responsibilities

• Act as Group owner of cyber security policies, standards and control libraries, approving material updates and keeping them aligned with industry best practice and regulation (ISO/IEC, NIST, CIS Controls, GSMA)
• Own the policy exception and risk acceptance process, including escalation thresholds, decision authorities and documentation of residual risk
• Define the Group Cybersecurity Controls and Risk Framework, including metrics, KRIs and gap indicators, and turn them into executive and Board-level insights
• Own the Compliance Assurance Framework and lead the move to continuous controls assurance, including a Group-wide digital GRC platform and automation and agentic AI
• Advise and challenge senior management and Boards, act as interface with auditors and external assessors, and engage with emerging technologies such as AI and quantum
• Assist in planning and managing GRC budgets and recommend resource allocation
• Collaborate with GRC leads across OpCos and engage business, technology and risk stakeholders

Required profile

• Bachelor's degree in computer science, information technology, cybersecurity or a related field
• At least 10 years of experience in cybersecurity, technology risk or GRC, in Group-level, regional or multi-entity environments
• Demonstrated experience leading large-scale cybersecurity or technology risk initiatives and engaging senior executives and Boards
• Professional certifications preferred: CISSP, CISM, CRISC, CCSP or equivalent

Required skills

• Deep expertise in cybersecurity governance, risk management and control frameworks (NIST CSF, ISO/IEC 27001/27002, CIS Controls)
• Strong understanding of telco, cloud and enterprise IT environments, including identity and access management, data protection and network security
• Ability to translate complex cyber risks into clear governance positions and Board-level risk narratives

What we offer

• Flexible work arrangements
• Full suite of health and wellness benefits
• Ongoing training and development programs
• Internal mobility opportunities