Onshore Cybersecurity Consultant
a) Provide cybersecurity support in system operations to ensure the compliance
with Government policies, which include review, design and implementing
security measure, process, controls for the Authority’s systems;
b) Review security audit reports and assessment conducted by auditors for security
testing such as Vulnerability assessment, penetration testing, host
configurations, IT general controls, risk assessments, etc;
c) Conduct reviews, gap analysis and provide recommendations on monthly
reports and reviews, ensuring the compliance of the system processes to the
Authority and Government policies;
d) Monitor and follow up with known vulnerabilities and risks in the Authority’s
environment and systems;
e) Conduct cybersecurity assessments to identify vulnerabilities and risks in the
Authority’s systems and processes;
f) Design and follow through the implement of cybersecurity solutions in the
Authority’s environment to protect against threats and attacks;
g) Review and verify that security policies, procedures, and best practices are
implemented and comply with standards and guidelines by the Authority’s
appointed contractors and systems;
h) Provide guidance and recommendations on cybersecurity strategies and
technologies;
i) Conduct security awareness trainings to the Authority and the Authority’s
appointed contractors when necessary to promote a culture of security;
j) Monitor and respond to security incidents and breaches, conducting forensic
analysis on a need-be basis; and
k) Stay current on emerging cybersecurity threats, trends, and technologies.
21. The One (1) Onshore Cybersecurity Consultant proposed by the Contractor shall have
at least 3 years of experience as a Cybersecurity Consultant or equivalent position and
the following skill sets:
a) Bachelor’s degree in computer science, Electrical/ Computer Engineer,
Information Technology or related discipline would be preferred;
b) Good capabilities in ICT governance, security/ risk/ data management
frameworks;
c) Good knowledge in ICT infrastructure, applications and web/ cloud services;
d) Qualified and certified ICT professionals such as CREST, CRISC, CGEIT and
CISSP; and
e) Knowledge of cybersecurity industry standards, government cyber security
policies and requirements.
