Total 4 information technology job vacancies in Legal / Public / Security category in sg office robinson road

Job Summary:

We are seeking a skilled and dedicated Information Security Analyst/Consultant to join our team. In this role, you will be responsible for advising, assisting, and implementing information security programs for our clients using frameworks such as ISO/IEC 27001:2022 and Cyber Trust Mark, in addition you will also be involve in overseeing the implementation of security solutions to assist clients in improving their information security and cyber security posture. You will work closely with clients to assess their security needs, develop robust security strategies, and ensure compliance with industry standards and are expected to manage client’s requirements and expectations during the consulting process helping them to achieve ISO/IEC 27001:2022 or Cyber Trust Mark Certification.

Key Responsibilities:

• Client Advisory and Consultation: Provide pre-sales support, expert advice and consultation to clients on information security practices and strategies.
• Framework Implementation: Assist clients in developing and implementing information security programs using frameworks like ISO/IEC 27001:2022 and Cyber Trust Mark.
• Security Assessments: Conduct comprehensive security assessments to identify vulnerabilities and recommend mitigation strategies.
• Policy Development: Develop and maintain information security policies, procedures, and guidelines for clients.
• Compliance and Auditing: Ensure client compliance with industry standards and regulatory requirements through regular audits and assessments.
• Risk Management: Identify, analyze, and manage information security risks for clients.
• Incident Response: Assist clients in developing incident response plans and provide support during security incidents.
• Training and Awareness: Conduct training sessions and workshops to raise awareness about information security best practices among client employees.
• Documentation: Prepare detailed reports and documentation for security assessments, policies, and compliance efforts.
• Monitoring Emerging Technologies and Threats: Stay up-to-date with emerging technologies and threats in AI, blockchain, and other relevant fields, and integrate this knowledge into security strategies.
• Security solutions: Understand and learn new cybersecurity solutions and assisting to implement these solutions to improve their security posture.

Qualifications:

• Education: Minimum diploma in Cyber Security, Computer Science, or related field and minimum 3 years of experience in IT or Cyber Security field.
• Certifications: Good to have certifications such as CISSP, CISM, or ISO/IEC 27001 Lead Auditor/Implementer, Certified Ethical Hacker.
• Experience: Proven experience in information security consulting, with a focus on implementing security frameworks like ISO/IEC 27001:2022, NIST, CSA Star and CIS.
• Skills: Strong analytical, problem-solving, and communication skills. Proficiency in security assessment tools and methodologies.
• Knowledge: In-depth knowledge of information security principles, standards, and best practices.
• Project management: Understanding of stakeholder management and managing project lifecycle.

What We Offer:

Opportunities for professional development and career growth. A dynamic and collaborative work environment.

Cybersecurity certification training opportunities

The Senior Director IT is responsible for establishing and maintaining the information security program to ensure that information assets and associated technology, applications, systems, infrastructure and processes are adequately protected in the digital ecosystem in which we operate. The individual is responsible for identifying, evaluating and reporting on legal and regulatory, compliance, IT and cybersecurity risk to information assets, while supporting and advancing business objectives.

Description

Establish Governance and Build Knowledge

• Facilitate an information security governance structure through the implementation of a hierarchical governance program, including the formation of an information security steering committee or advisory board.
• Provide regular reporting on the current status of the information security program to enterprise risk teams and senior business leaders
• Work with the vendor management office to ensure that information security requirements are included in contracts by liaising with vendor management and procurement organizations.
• Create and manage a targeted information security awareness training program for all employees, contractors and approved system users, and establish metrics to measure the effectiveness of this security training program for the different audiences.
• Understand and interact with related disciplines through committees to ensure the consistent application of policies and standards across all technology projects, systems and services, including privacy, risk management, compliance and business continuity management.
• Provide clear risk mitigating directives for projects with components in IT, including the mandatory application of controls.

Develop the Frameworks

• Develop and enhance an up-to-date information security management framework based on one of the following: International Organization for Standardization (ISO) 2700X, ITIL, ENISA, ISA-62443, COBIT/Risk IT and National Institute of Standards and Technology (NIST) Cybersecurity Framework.
• Create and manage a unified and flexible control framework to integrate and normalize the wide variety and ever-changing requirements resulting from global laws, standards and regulations.
• Develop and maintain a document framework of continuously up-to-date information security policies, standards and guidelines. Oversee the approval and publication of these information security policies and practices.
• Create a framework for roles and responsibilities with regard to information ownership, classification, accountability and protection of information assets.
• Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the information security, and review it with stakeholders at the executive and board levels.

Architecture/Engineering Support

• Work with IT staff to ensure that security is factored into the evaluation, selection, installation and configuration of hardware, applications and software.
• Recommend and coordinate the implementation of technical controls to support and enforce defined security policies.
• Research, evaluate, design, test, recommend or plan the implementation of new or updated information security hardware or software, and analyze its impact on the existing environment; provide technical and managerial expertise for the administration of security tools.
• Work with the enterprise architecture team to ensure that there is a convergence of business, technical and security requirements; liaise with IT management to align existing technical installed base and skills with future architectural requirements.

Operational Execution

• Coordinate, measure and report on the technical aspects of security management.
• Manage outsourced vendors that provide information security functions for compliance with contracted service-level agreements.
• Manage and coordinate operational components of incident management, including detection, response and reporting.
• Maintain a knowledgebase comprising a technical reference library, security advisories and alerts, information on security trends and practices, and laws and regulations.
• Manage the day-to-day activities of threat and vulnerability management, identify risk tolerances, recommend treatment plans and communicate information about residual risk.
• Manage security projects and provide expert guidance on security matters for other IT projects.
• Assist and guide the disaster recovery planning team in the selection of recovery strategies and the development, testing and maintenance of disaster recovery plans.
• Ensure audit trails, system logs and other monitoring data sources are reviewed periodically and are in compliance with policies and audit requirements.
• Design, coordinate and oversee security testing procedures to verify the security of systems, networks and applications, and manage the remediation of identified risks.

Qualifications

• Bachelor’s Degree in Engineering, Computer Science, Information Systems, or related discipline required.
• Master’s Degree in a related field is preferred.
• Professional security management certification is desirable, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials

Experiences

• A minimum of ten years of IT experience, with seven years in an information security role and at least five years in a managerial capacity is required.
• Experience working with legal, audit and compliance staff is preferred.
• Experience developing and maintaining policies, procedures, standards and guidelines is required.
• Familiarity with applicable legal and regulatory requirements, including, but not limited to, the U.S. Sarbanes-Oxley Act, the U.S. Health Insurance Portability and Accountability Act (HIPAA), the European Union Privacy Directive, and the Japanese Financial Instruments and Exchange Law ("J-SOX").

Skill Sets

• Excellent analytical skills, the ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives
• Project management skills: financial/budget management, scheduling and resource management
• Ability to lead and motivate the information security team to achieve tactical and strategic goals, even when only "dotted line" reporting lines exist
• A master of influencing entities and decisions in situations where no formal reporting structures exist, but achieving the desirable outcome is vital
• Excellent communication, interpersonal and collaborative skills. Experience working with a multi-continent technical team preferred
• High degree of initiative, dependability and ability to work with little supervision while being resilient to change

Technical Competencies

• Experience with common information security management frameworks, such as International Standards Organization (ISO) 2700x, the IT Infrastructure Library (ITIL) and Control Objectives for Information and Related Technology (COBIT) frameworks
• An understanding of operating system internals and network protocols.
• Familiarity with the principles of cryptography and cryptanalysis.
• Experience in application technology security testing (white box, black box and code review).
• Experience in system technology security testing (vulnerability scanning and penetration testing).

Job purpose:

This position is part of the Asia information Security and Data Protection function in Singapore with focus on data loss prevention (DLP) and data protection (DP).

Key activities:

• Serving as the primary point of contact for authorities and stakeholders regarding compliance with Data Loss Prevention (DLP) regulations and the support to data protection (DP).
• Maintaining data protection policies, procedures, and guidelines, monitoring compliance with data protection laws and regulations and data loss prevention related requirements and ensuring appropriate measures are in place.
• Conducting data protection impact assessments (DPIAs) to identify and mitigate risks associated with the processing of personal data.
• Collaborating with IT, legal, HR, and other departments to ensure data protection considerations and controls are integrated into business processes and systems.
• Investigating incidents and breaches related to data loss, breach, or unauthorized access.
• Collaborating with internal teams to integrate DLP solutions with existing infrastructure and security systems. e.g. management of DLP policy and ruleset
• Providing advice, guidance, and training to employees on data protection requirements, best practices, and data breach procedures
• Assisting the Head of Information Security Asia and Data Protection officers in developing and delivering reports to senior management on the organization's data loss prevention and data protection compliance status
• Collaborating with auditors to provide necessary documentation, evidence, and support during audit fieldwork, testing, and reporting phases.
• Reviewing audit findings, recommendations, and reports to identify opportunities for improving information security practices, processes, and controls.

Formal education:

• University or college degree or comparable
• Possession of professional qualifications will be advantageous. e.g. CIPM, CIPP, CISA, CISM, CISSP, CRISC, PMP

Specialist knowledge (work experience, further qualification):

• Minimum 5+ years of related experience in Data Protection, Data Loss Prevention or technology Risk function in financial services industry or consultancy
• Extensive knowledge of the regulatory environment and data protection laws within the Asia region. PDPC, MAS, NAFR, PBOC, JFA
• Experience in cybersecurity, risk management, and familiarity with DLP technologies would be an advantage.
• Strong analytical skills, with the ability to breakdown complex problems into actionable and understandable steps.
• Strong communication, stakeholder management and problem-solving skills are essential.

Job purpose:

This position is part of the Asia information Security and Data Protection function in Singapore with focus on information security and third-party risk management.

Key activities:

• Assisting the Head of Information Security Asia in implementing and maintaining the Group's information security strategy, policies, and procedures to manage cyber and Third-Party Information Security risk and ensure compliance with relevant laws and regulations.
• Assessing the security posture of third-party vendors, partners, or service providers to ensure compliance with organizational standards and regulatory requirements.
• Collaborating with procurement, legal, and business units to evaluate the security implications of engaging with third-party vendors and providing guidance and recommendations to stakeholders on selecting, onboarding, and managing third-party vendors securely.
• Reviewing and negotiating information security and data protection clauses in contracts and agreements with third-party vendors to establish security requirements and responsibilities.
• Conducting risk assessments of third-party systems (including cloud), networks, and processes to identify gaps in information security controls.
• Collaborate with head office in developing and implementing strategies in continue monitoring and evaluating third-party security performance through regular assessments and audits.
• Participating in cross-functional teams or committees on vendor risk management and security governance driven regionally and globally.
• Collaborating with auditors to provide necessary documentation, evidence, and support during audit fieldwork, testing, and reporting phases.
• Reviewing audit findings, recommendations, and reports to identify opportunities for improving information security and third-party risk management practices, processes, and controls.

Formal education:

• University or college degree or comparable
• Possession of professional qualifications will be advantageous. e.g. CISA, CISM, CRISC, CISSP, CTPRP

Specialist knowledge (work experience, further qualification):

• Minimum 5+ years of related experience in Information Security, third-party risk management or technology Risk function in financial services industry or consultancy.
• Knowledge of Asia regulatory requirements with a strong understanding of the financial industry. PDPC, MAS, NAFR, PBOC, JFA
• Have a strong security risk and analytical mindset in approaching situations and interactions with stakeholders.
• Strong communication and interpersonal skills, with an ability to translate complex technical information for a non-technical audience.