Senior Cybersecurity Governance Specialist
Senior GRC role in Singapore GovTech's Cyber Security Group: you architect and run the Ministry-wide security governance and risk framework — risk registers, threat risk assessments, Zero Trust standards, supply-chain and audit readiness — advising CIOs/CISOs across IT, cloud (GCC) and OT/ICS environments. Needs 10–12 years in cybersecurity GRC, risk management or security architecture.
- Compensation
- Not disclosed
- Location
- Singapore
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- 10–12 years in Cybersecurity GRC, Information Security Risk Management, or Security Architecture
- Proven experience managing risks across IT and Cloud environments
- Deep familiarity with Singapore Government security policies (e.g., Instruction Manual on IT Management) and international standards (e.g., NIST, ISO 27001)
- Mastery of risk assessment methodologies (e.g., TVRA) and ability to translate technical vulnerabilities into business risk
- Strong technical understanding of Zero Trust Architecture (ZTA) components and cloud security technologies (Firewalls, EDR, IAM, SIEM, CSPM, CWPP, CASB, secrets management)
- Ability to map technical controls to the MITRE ATT&CK framework to ensure defensive coverage
- Proficiency in manual and automated testing tools; deep understanding of MITRE ATT&CK framework and common TTPs
- Ability to educate and persuade senior stakeholders (CIOs/Project Owners) on rigorous risk governance
- Ability to look past surface-level audit compliance to find and fix underlying systemic issues
- Genuine passion for staying updated on the latest security technologies and evolving cyber threat landscapes
- Exceptional ability to translate deep technical issues into business risk for non-technical senior executives
Nice to have
- Exposure to OT (Operational Technology) systems
- Professional certifications such as CISM, CRISC, CISSP, OSCP or OSWE
Full description
[What the role is]
GovTech is the lead agency driving Singapore’s Smart Nation initiatives and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (ICT & SS), GovTech develops the Singapore Government’s capabilities in Data Science & Artificial Intelligence, Application Development, Smart City Technology, Digital Infrastructure, and Cybersecurity.
At GovTech, we offer you a purposeful career to make lives better where we empower our people to master their craft through robust learning and development opportunities all year round.
Play a part in Singapore’s vision to build a Smart Nation and embark on your meaningful journey to build tech for public good. Join us to advance our mission and shape your future with us today!
Learn more about GovTech at tech.gov.sg.
[What you will be working on]
The Cyber Security Group (CSG) is the cybersecurity arm of GovTech. CSG is committed to create a digital government that is safe and secure. CSG delivers technical and operational capabilities to counteract cyber threats, provides thought leadership on transformative cybersecurity governance and policies and to strengthen the cybersecurity posture of government agencies in a manner that is sustainable, pragmatic, and effective.
To enhance infocomm security capabilities in GovTech and the Whole-of-Government (WOG), GovTech appoints Chief Information Security Officer (CISO) teams at the various ministries to oversee infocomm security management.
Reporting to the Ministry CISO (MCISO), you will be the primary architect of the Ministry’s security governance and risk management framework. You will ensure that all agencies within the Ministry Family operate under a unified, effective, and modern security standard. Your mission is to transform GRC from a compliance-heavy exercise into a strategic enabler. You will establish the frameworks that allow the Ministry Family to adopt new technologies with confidence, moving away from a "risk-averse" posture toward a "risk-informed" one. You will ensure that risk management is deeply integrated into the lifecycle of every digital system, from web applications to critical Operational Technology (OT) environments.
Key Responsibilities
- Enterprise Risk Governance & Management
- Dynamic Risk Registers: Establish and oversee the Ministry-wide security risk register. You will ensure that registers are not static documents but "living" tools that accurately reflect the current threat landscape and project status across all agencies.
- Senior Management Facilitation: Lead and facilitate high-level risk conversations with Senior Management and Agency CIOs. You must be able to translate complex technical risks into clear business impacts to drive informed resource allocation and prioritisation.