Office of Information Services - Asst Mgr/Dy Mgr (Programme & Compliance)

[What the role is]

Assistant Manager / Deputy Manager (Programme & Compliance)

[What you will be working on]

• Identify and analyse ICT, data, and AI security threats using tools such as SIEM, vulnerability scanners, and threat intelligence platforms, and translate findings into actionable risk mitigation measures
• Coordinate and liaise on audit and compliance matters with internal and external parties
• Ensure RP’s compliance with IM8 policies and directives, and serve as RP’s security officer for all ICT systems and digital services, maintaining an up-to-date register of systems and associated security controls
• Follow up on ICT cyber and data security incidents, supporting investigation, containment, and recovery efforts
• Develop, enforce, and maintain ICT and data security policies, procedures, and guidelines, keeping them current with evolving threats and whole-of-government directives
• Implement ICT and data security measures across on-premise and cloud environments, including the Government Commercial Cloud (GCC)
• Develop and deliver security awareness programmes for staff and students

[What we are looking for]

•Relevant qualification in Information Technology, Computer Science, Information Security, or a related field
• At least 2 to 4 years of IT or Cyber/Data Security experience
• Familiarity with the Singapore public sector ICT and data security landscape, including System Security Plan, as well as security frameworks such as ISO 27001 or National Institute of Standards and Technology Cybersecurity Framework
• Hardworking, dynamic, and takes initiative; able to multi-task, manage diverse portfolios, and work independently as well as collaboratively with cross-functional teams
• Familiarity with ITIL; professional certifications such as CISSP is a plus; interest in AI governance and AI security risks will be highly regarded 
• Experience in one or more of the following is preferred: security and compliance operations, cloud security and DevSecOps practices, enterprise application or infrastructure systems deployment, IT operations, or business analytics solutions