Senior/Lead Cybersecurity Engineer, TradeNet

About the role

GovTech is seeking a Cybersecurity Engineer to act as the security subject matter expert for a critical national digital platform. The role sits at the intersection of engineering delivery and regulatory compliance, translating policy requirements (IM8 Reform, CSA CCOPv2) into technical controls while working with product and engineering teams in an agile environment.

Key responsibilities

• Cloud and infrastructure security: assess and validate controls across IaaS/PaaS/SaaS environments (identity, encryption, network segmentation); govern WAF, DAM and firewall policies and oversee vendor operations and change management.
• Application security: triage OWASP Top 10 findings, reproduce and validate issues, coordinate retesting, and ensure secure SDLC practices.
• Regulatory compliance and risk: translate CSA Cybersecurity Act (CII CCOPv2) and WOG IM8 high-risk cloud requirements into controls; log and track GCSOC/GITSIR advisories; manage vulnerability disclosure programme findings end to end; conduct risk assessments mapped to ISO 27001, NIST, CIS and other frameworks; support internal and external audits.
• Threat modelling and operations: threat modelling using MITRE ATT&CK for the CII landscape; support VAPT, incident response and incident management; help design technical solutions for new security requirements.
• Stakeholder engagement: liaise between CSA, Agency CISO and engineering teams, drive remediation, manage cross-functional initiatives, use automation for compliance monitoring, set and track KPIs, and champion agile security practices.

Required profile

• Minimum 5 years of cybersecurity engineering experience, with hands-on work in security operations, risk assessment or compliance in cloud environments.
• Working knowledge of Singapore frameworks WOG IM8 Reform and CSA CCOPv2.
• Experience supporting audit cycles and producing compliance evidence.
• Ability to explain technical security concepts to policy and compliance stakeholders and to balance security with delivery timelines.
• Onsite presence during fixed hours may be required depending on the role.

Required skills

• Hands-on experience with SIEM, CSPM, ASM, WAF and vulnerability management tools.
• Familiarity with OWASP, MITRE ATT&CK, ISO 27001, NIST and CIS benchmarks.
• Scripting in at least one language such as Python, PowerShell or YARA.
• Certifications such as GCIH, GCFA, OSCP, CISSP or AWS Security Specialty are advantageous; in-house VAPT experience is a strong plus.

What we offer

• A total rewards package with leave benefits and employee wellness programs.
• Flexible work arrangements (subject to the job role).