PURPOSE
· Supports BISO in providing oversight and governance of IT risk and security policy requirements for FWD Singapore.
· Serves as the process owner and handles all the IT security risks and related issues of FWD Singapore
· Ensure IT operations and activities comply with IT security standards set by FWD Group and regulatory standards as required by the Monetary Authority of Singapore (MAS) & Personal Data Protection Commission.
· Ensures IT risk and security controls implementation in compliance with business strategies, organization policies and requirements.
KEY ACCOUNTAIBILITIES.
· Ensure relevant IT Security processes and controls are implemented in FWD Singapore, which includes advisory and support for such activities.
· Conduct security reviews and risk assessments on business and IT projects and initiatives, perform relevant security assessments based on SDLC lifecycle.
· Review web application security scanning reports, penetration testing and vulnerabilities reports and plan remediation strategies.
· Manage and review firewall policies.
· Coordinate with FWD Group to ensure Third Party Security Risk Assessments are performed for external existing and new partners/ vendors.
· Perform ad-hoc and periodic IT security control reviews as per FWD policies and regulatory requirements.
· Ensure that IT security incidents are investigated, reported, and associated risks being managed.
· Support and advise on the implementation of new or enhanced security management and monitoring tools based on the directions given by FWD Group.
· Actively participate as required in annual BIA, DR and BCP exercises.
· Coordinating and preparing for audits, support the resolution of audit findings and ensuring closure.
· Support and ensure the proper reporting of KRIs to management.
· Assist and lead as relevant in any ad-hoc tasks and IT security projects.
Supervise and train junior staffs on performing their respective tasks as required.
QUALIFICATIONS / EXPERIENCE
· Minimum 6-8 years working experience in implementing IT risk, security, and operations control, preferably in Financial Institutions.
· Degree from Information Technology or equivalent.
· Information Security Certification / Accreditation preferred (e.g., CISSP, CCSP, CISA. CISM).
· Expert knowledge of IT security and risk disciplines and practices.
· Advanced knowledge of organization, technology controls, security and risk issues
· Familiar with Cloud Technology such as AWS or Azure.
KNOWLEDGE, SKILLS & ABILITY
· Excellent interpersonal and influencing skills as well as proven analytical skills to enable the implementation of security program and MAS TRM compliance activities.
· Sound knowledge of Information Security management frameworks and best practices.
· Good communication skills, able to communicate with senior management and other business functions.
Technical skills and hands-on experience on IT security related solutions (endpoint protection, vulnerability management, security hardening, firewalls, web application security scanning, etc.)
