Senior Software Engineer, Governance, Risk & Compliance (GRC), Singpass
Hands-on Senior Software Engineer on the Singpass GRC team building continuous, machine-verified compliance for Singapore's national digital identity system. Day to day: writing Go services, collectors and data pipelines that instrument OpenShift, GitLab CI/ArgoCD, YugabyteDB and AWS to auto-generate audit evidence and power live compliance dashboards.
- Compensation
- Not disclosed
- Location
- Singapore
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Contract
- Experience
- 5+ years
- Category
- Security
- Posted
Skills
Must have
- 5+ years of professional software engineering, building and operating production backend, platform or data systems
- Strong proficiency in Go, including concurrency, testing, and building production services and CLIs
- Hands-on experience running workloads on Kubernetes or OpenShift, including API server, RBAC, admission control, operators/controllers and audit logging
- Practical experience extending CI/CD systems (GitLab CI preferred) and GitOps tooling (ArgoCD)
- Experience designing data models and ingestion pipelines for event, log or time-series data, with strong SQL skills
- Solid grasp of identity and access management, least privilege, encryption, secrets handling, logging integrity and secure software supply chains
- Able to translate control statements into precise, automatable checks and explain technical results to auditors or policy officers
- Ownership mindset: finds gaps and ships improvements end to end without waiting for a ticket
- Writes clear designs, runbooks and developer guides (documentation first)
- Understands responsibility of working on national identity infrastructure and handling sensitive audit data
Nice to have
- Experience writing Kubernetes controllers or operators
- Experience with policy-as-code (OPA/Rego, Gatekeeper, Kyverno) or compliance-as-code frameworks (OSCAL, OpenSCAP, Compliance Operator)
- Experience with software supply-chain security such as Sigstore/cosign, SLSA, in-toto attestations and SBOM generation
- Exposure to distributed SQL databases (YugabyteDB, CockroachDB, PostgreSQL at scale), including database auditing and access governance
- Experience with secrets management platforms (OpenBao or HashiCorp Vault) and AWS security services (CloudTrail, Config, Security Hub)
- Familiarity with control frameworks and audit regimes such as IM8, ISO/IEC 27001, SOC 2, NIST SP 800-53, PCI DSS or MAS TRM
- Experience building observability or analytics products (Grafana, OpenSearch, ClickHouse or similar) for non-engineering audiences
- Experience building frontend applications in TypeScript (React or similar)
- Prior experience in highly regulated, high-availability environments (government, defence, fintech)
Full description
GovTech is the lead agency driving Singapore's Smart Nation initiatives and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (ICT & SS), GovTech develops the Singapore Government's capabilities in Data Science & Artificial Intelligence, Application Development, Smart City Technology, Digital Infrastructure, and Cybersecurity. At GovTech, we offer you a purposeful career to make lives better, and we help our people master their craft through learning and development opportunities all year round.
Singpass is Singapore's national digital identity system. It provides high-assurance authentication, digital signatures, corporate identity (Corppass) and government-verified data sharing (Myinfo) to millions of residents and thousands of government and private-sector services. Because it is critical national infrastructure, Singpass is audited continuously against strict security and regulatory controls. Today, most of that audit evidence is collected by hand, point in time, in screenshots and spreadsheets. We want to replace that with continuous, machine-verified compliance: every control measured live, every piece of evidence produced automatically, and every drift detected within minutes instead of at the next audit cycle.
This is a hands-on software engineering role. You will design, write and operate production code and data pipelines. It is not a GRC analyst, audit management or policy-writing role. We are looking for engineers who treat compliance as a software problem: controls as code, evidence as data, audits as queries.
[What you will be working on]
You will join the Singpass GRC engineering effort, working with the Core Platform team, which runs the shared foundations that every Singpass product team builds on: multi-cluster OpenShift on AWS, Istio Ambient service mesh, GitLab CI, ArgoCD GitOps, OpenBao secrets management and YugabyteDB distributed SQL. Your job is to instrument these systems so that their compliance posture can be observed, measured and proven continuously, and to bring the results together in a single pane of glass that auditors, security and engineering leadership can query 24/7.
Continuous Controls Monitoring & Evidence Automation
- Integrate with the delivery pipeline: Build integrations into GitLab CI and ArgoCD to capture change-management evidence automatically: who changed what, who reviewed and approved it, which tests and security scans ran, and what was deployed where. Target outcomes include signed artefacts, SBOMs, provenance attestations and separation of duties.
- Instrument the container platform: Collect and normalise control signals from OpenShift clusters, such as Compliance Operator / CIS benchmark results, admission and policy-engine decisions, RBAC and privileged-access state, network and authorization policies, image provenance and Kubernetes audit logs.