The scope of Services for the One (1) Onshore Cybersecurity Consultant shall be
as follows:
a) Provide cybersecurity support in system operations to ensure the
compliance with Government policies, which include review, design and
implementing security measure, process, controls for the Authority’s
systems;
b) Review security audit reports and assessment conducted by auditors for
security testing such as Vulnerability assessment, penetration testing, host
configurations, IT general controls, risk assessments, etc;
c) Conduct reviews, gap analysis and provide recommendations on monthly
reports and reviews, ensuring the compliance of the system processes to the
Authority and Government policies;
RFQ SPECIFICATIONS
d) Monitor and follow up with known vulnerabilities and risks in the
Authority’s environment and systems;
e) Conduct cybersecurity assessments to identify vulnerabilities and risks in
the
Authority’s systems and processes;
f) Design and follow through the implement of cybersecurity solutions in the
Authority’s environment to protect against threats and attacks;
g) Review and verify that security policies, procedures, and best practices are
implemented and comply with standards and guidelines by the Authority’s
appointed contractors and systems;
h) Provide guidance and recommendations on cybersecurity strategies and
technologies;
i) Conduct security awareness trainings to the Authority and the Authority’s
appointed contractors when necessary to promote a culture of security;
j) Monitor and respond to security incidents and breaches, conducting
forensic analysis on a need-be basis; and
k) Stay current on emerging cybersecurity threats, trends, and technologies.
21. The One (1) Onshore Cybersecurity Consultant proposed by the Contractor shall
have at least 3 years of experience as a Cybersecurity Consultant or equivalent
position and the following skill sets:
a) Bachelor’s degree in computer science, Electrical/ Computer Engineer,
Information Technology or related discipline would be preferred;
b) Good capabilities in ICT governance, security/ risk/ data management
frameworks;
c) Good knowledge in ICT infrastructure, applications and web/ cloud
services;
d) Qualified and certified ICT professionals such as CREST, CRISC, CGEIT
and CISSP; and
e) Knowledge of cybersecurity industry standards, government cyber security
policies and requirements.
