Identify suspicious behaviours, attack patterns, lateral movement indicators, privilege misuse, exposed services, anomalous access, and other signs of compromise.
Perform structured threat modelling on systems and applications, identifying potential threats and attack vectors, and recommending proportionate mitigation controls aligned to the risk profile of the system
Scope of WorkThe Information Technology Security Officer will support the Board's cybersecuritygovernance, assurance, and security management activities across security architecture,vulnerability assessment and penetration testing, risk assessment, system hardening, cloudsecurity posture management, software clearance, firewall and network deviationmanagement, cybersecurity policies and standards, and security metrics reporting.The officer will coordinate security reviews and assessments, maintain cybersecurity registersand trackers, follow up on remediation and outstanding actions with relevant stakeholders,prepare security reports and management dashboards, and support the upkeep ofcybersecurity policies, standards, specifications, and documentation.This role requires strong coordination, analytical, documentation, and stakeholdermanagement skills, with a good understanding of enterprise cybersecurity controls, riskmanagement, and governance processes.2. Roles and ResponsibilitiesSecurity Architecture• Assist in maintaining security architecture diagrams, records, and approved designdocumentation.• Track security architecture review requests and coordinate inputs from project teamsand relevant stakeholders.• Maintain records of architecture decisions, recommendations, and approved designs.• Support preparation of security advisory materials and architecture reviewdocumentation.Vulnerability Assessment & Penetration Testing• Coordinate and schedule VAPT engagements with system owners, vendors, andsecurity testers.• Maintain the VAPT tracker and follow up on remediation of identified vulnerabilities.• Coordinate re-testing activities and update finding closure status.• Assist in preparing VAPT reports, summaries, and presentation materials.Risk Assessment• Coordinate cybersecurity risk assessment exercises with system owners andstakeholders.• Maintain the cybersecurity risk register and track risk treatment and remediationactions.• Support preparation of risk reports and management review materials.• Facilitate risk acceptance, exception, and approval processes in accordance with theBoard's requirements.Hardening Compliance• Coordinate security hardening compliance assessments with system and infrastructureteams.• Track hardening gaps and follow up on remediation progress.• Maintain hardening compliance records, checklists, and trackers.• Support preparation of periodic hardening compliance reports.Cloud Security Posture Management• Monitor and triage findings generated by Cloud Security Posture Management tools.• Track cloud security misconfigurations and follow up on remediation with system andcloud owners.• Maintain CSPM findings and remediation status records.• Prepare periodic cloud security posture reports and summaries.Software Clearance• Receive, log, and track software security clearance requests.• Coordinate with requestors and vendors to obtain required technical and securitydocumentation.• Maintain the software clearance register and approval status.• Support preparation of software security evaluation summaries and monitor expiringclearances.Firewall & Network Deviation Management• Receive, track, and maintain firewall rule change and network security deviationrequests.• Follow up with requestors and network teams on outstanding actions and expiringdeviations.• Maintain deviation registers and prepare review summaries for approval.• Coordinate periodic firewall rule and network deviation reviews with relevant teams.Policy, Standards & Governance / Cyber Specifications• Assist in drafting, reviewing, and updating cybersecurity policies, standards,guidelines, and procedures.• Maintain the cybersecurity policy and standards documentation repository.• Track document review cycles, approvals, and expiry dates.• Support preparation and review of cybersecurity specifications for projects,procurements, and tenders.Security Metrics & Reporting• Collate and consolidate cybersecurity data and status updates from relevant teams andsystems.• Maintain cybersecurity dashboards covering vulnerabilities, risks, deviations,compliance, and audit items.• Prepare routine security metrics and management reports.• Follow up with responsible parties on outstanding cybersecurity actions andremediation items.Security & Compliance• Ensure activities are performed in accordance with the Board's cybersecurity policies,applicable regulatory requirements, and the Cybersecurity Code of Practice (CCoP).• Support cybersecurity assessments, internal and external audits, and evidencecollection activities.• Maintain accurate and up-to-date cybersecurity records, reports, registers, andsupporting documentation.• Protect sensitive and security-classified information in accordance with the Board'srequirements.3. Technical RequirementsMandatory Technical Skills• Good understanding of enterprise cybersecurity concepts, including vulnerabilitymanagement, security risk assessment, system hardening, firewall controls, cloudsecurity, and security governance.• Experience coordinating cybersecurity assessments, remediation activities, andsecurity review processes involving multiple technical and business stakeholders.• Ability to review and understand vulnerability assessment findings, security riskassessments, security architecture diagrams, firewall rules, and security compliancereports.• Familiarity with security frameworks, policies, standards, and cybersecuritygovernance processes.• Strong analytical, documentation, stakeholder coordination, and follow-up skills.Good-to-Have• Familiarity with CSPM platforms and cloud security concepts across AWS, Azure, orequivalent cloud environments.• Experience with vulnerability management or VAPT tools and interpretingCVE/CVSS information.• Understanding of enterprise network architecture, firewall rules, security zones, andnetwork segmentation.• Experience supporting cybersecurity audits, governance, risk, and complianceactivities.Certifications• CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or equivalentfoundational cybersecurity certification is highly preferred.• Certified Information Systems Security Professional (CISSP), Certified InformationSecurity Manager (CISM), or equivalent will be advantageous.• Certified in Risk and Information Systems Control (CRISC), ISO 27001-relatedcertification, or equivalent risk/governance certification will be advantageous.• Relevant cloud security certification such as Microsoft Azure Security, AWSSecurity, or equivalent will be advantageous.4. Working Arrangement• Onsite at designated PUB secure premises in Singapore, as required.• The officer will work closely with system owners, infrastructure teams, cybersecurityteams, project teams, vendors, and contractors.• Must comply with all security, confidentiality, and access control requirements ofPUB premises and systems.• The officer shall be subjected to security clearance by the Board prior tocommencement of work.
Scope of WorkThe Information Technology Security Officer will support the Board's cybersecuritygovernance, assurance, and security management activities across security architecture,vulnerability assessment and penetration testing, risk assessment, system hardening, cloudsecurity posture management, software clearance, firewall and network deviationmanagement, cybersecurity policies and standards, and security metrics reporting.The officer will coordinate security reviews and assessments, maintain cybersecurity registersand trackers, follow up on remediation and outstanding actions with relevant stakeholders,prepare security reports and management dashboards, and support the upkeep ofcybersecurity policies, standards, specifications, and documentation.This role requires strong coordination, analytical, documentation, and stakeholdermanagement skills, with a good understanding of enterprise cybersecurity controls, riskmanagement, and governance processes.2. Roles and ResponsibilitiesSecurity Architecture• Assist in maintaining security architecture diagrams, records, and approved designdocumentation.• Track security architecture review requests and coordinate inputs from project teamsand relevant stakeholders.• Maintain records of architecture decisions, recommendations, and approved designs.• Support preparation of security advisory materials and architecture reviewdocumentation.Vulnerability Assessment & Penetration Testing• Coordinate and schedule VAPT engagements with system owners, vendors, andsecurity testers.• Maintain the VAPT tracker and follow up on remediation of identified vulnerabilities.• Coordinate re-testing activities and update finding closure status.• Assist in preparing VAPT reports, summaries, and presentation materials.Risk Assessment• Coordinate cybersecurity risk assessment exercises with system owners andstakeholders.• Maintain the cybersecurity risk register and track risk treatment and remediationactions.• Support preparation of risk reports and management review materials.• Facilitate risk acceptance, exception, and approval processes in accordance with theBoard's requirements.Hardening Compliance• Coordinate security hardening compliance assessments with system and infrastructureteams.• Track hardening gaps and follow up on remediation progress.• Maintain hardening compliance records, checklists, and trackers.• Support preparation of periodic hardening compliance reports.Cloud Security Posture Management• Monitor and triage findings generated by Cloud Security Posture Management tools.• Track cloud security misconfigurations and follow up on remediation with system andcloud owners.• Maintain CSPM findings and remediation status records.• Prepare periodic cloud security posture reports and summaries.Software Clearance• Receive, log, and track software security clearance requests.• Coordinate with requestors and vendors to obtain required technical and securitydocumentation.• Maintain the software clearance register and approval status.• Support preparation of software security evaluation summaries and monitor expiringclearances.Firewall & Network Deviation Management• Receive, track, and maintain firewall rule change and network security deviationrequests.• Follow up with requestors and network teams on outstanding actions and expiringdeviations.• Maintain deviation registers and prepare review summaries for approval.• Coordinate periodic firewall rule and network deviation reviews with relevant teams.Policy, Standards & Governance / Cyber Specifications• Assist in drafting, reviewing, and updating cybersecurity policies, standards,guidelines, and procedures.• Maintain the cybersecurity policy and standards documentation repository.• Track document review cycles, approvals, and expiry dates.• Support preparation and review of cybersecurity specifications for projects,procurements, and tenders.Security Metrics & Reporting• Collate and consolidate cybersecurity data and status updates from relevant teams andsystems.• Maintain cybersecurity dashboards covering vulnerabilities, risks, deviations,compliance, and audit items.• Prepare routine security metrics and management reports.• Follow up with responsible parties on outstanding cybersecurity actions andremediation items.Security & Compliance• Ensure activities are performed in accordance with the Board's cybersecurity policies,applicable regulatory requirements, and the Cybersecurity Code of Practice (CCoP).• Support cybersecurity assessments, internal and external audits, and evidencecollection activities.• Maintain accurate and up-to-date cybersecurity records, reports, registers, andsupporting documentation.• Protect sensitive and security-classified information in accordance with the Board'srequirements.3. Technical RequirementsMandatory Technical Skills• Good understanding of enterprise cybersecurity concepts, including vulnerabilitymanagement, security risk assessment, system hardening, firewall controls, cloudsecurity, and security governance.• Experience coordinating cybersecurity assessments, remediation activities, andsecurity review processes involving multiple technical and business stakeholders.• Ability to review and understand vulnerability assessment findings, security riskassessments, security architecture diagrams, firewall rules, and security compliancereports.• Familiarity with security frameworks, policies, standards, and cybersecuritygovernance processes.• Strong analytical, documentation, stakeholder coordination, and follow-up skills.Good-to-Have• Familiarity with CSPM platforms and cloud security concepts across AWS, Azure, orequivalent cloud environments.• Experience with vulnerability management or VAPT tools and interpretingCVE/CVSS information.• Understanding of enterprise network architecture, firewall rules, security zones, andnetwork segmentation.• Experience supporting cybersecurity audits, governance, risk, and complianceactivities.Certifications• CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or equivalentfoundational cybersecurity certification is highly preferred.• Certified Information Systems Security Professional (CISSP), Certified InformationSecurity Manager (CISM), or equivalent will be advantageous.• Certified in Risk and Information Systems Control (CRISC), ISO 27001-relatedcertification, or equivalent risk/governance certification will be advantageous.• Relevant cloud security certification such as Microsoft Azure Security, AWSSecurity, or equivalent will be advantageous.4. Working Arrangement• Onsite at designated PUB secure premises in Singapore, as required.• The officer will work closely with system owners, infrastructure teams, cybersecurityteams, project teams, vendors, and contractors.• Must comply with all security, confidentiality, and access control requirements ofPUB premises and systems.• The officer shall be subjected to security clearance by the Board prior tocommencement of work.
Build and maintain robust technical defences installing, configuring, and managing essential security infrastructure – including firewalls, endpoint protection (EDR), and strict identity access controls, while ensuring all new IT projects are designed securely from the ground up.
Perform structured threat modelling on systems and applications, identifying potential threats and attack vectors, and recommending proportionate mitigation controls aligned to the risk profile of the system
In charge of ensuring that the project delivers as-sold solution, remains within the baseline budget and is delivered on time whilst maintaining quality criteria and client satisfaction
Govern the identity lifecycle: Establish controls for privileged accounts, service accounts, application identities, API credentials, workload identities and AI agents, including discovery, onboarding, recertification, credential rotation and decommissioning.