全职 Security Analyst 工作, 薪水 up to SGD 8,000, OPENSOURCE PTE. LTD. 公司招聘中 - Ricebowl

Key Responsibilities

Vulnerability Management

• Own and manage the end-to-end Vulnerability Management process, including intake, triage, and lifecycle tracking of security findings across the organization's systems and assets.

• Classify vulnerabilities by severity, exploitability, and business impact using frameworks such as CVSS, EPSS, and internal risk criteria.

• Plan, coordinate, and manage Quarterly Vulnerability Assessments — scoping targets, engaging scanning tools, reviewing outputs, and driving findings through to resolution.

• Manage the Yearly Penetration Testing cycle, including scoping, vendor coordination, findings review, and tracking remediation commitments through to closure.

• Track key remediation implementations end-to-end, maintaining visibility from initial detection through to verified closure — for example, overseeing the transition of WAF rules from detection mode to prevention mode, ensuring each step is documented, tested, and signed off.

• Coordinate with remediation teams (engineering, DevOps, infrastructure) to ensure timely resolution of findings, providing clear context and prioritization guidance.

• Maintain and update risk acceptance records, ensuring appropriate approvals are obtained, documented, and reviewed on schedule.

• Track and report on remediation SLAs, escalating overdue or high-risk items to the appropriate stakeholders.

• Produce regular status reports and dashboards that communicate the project's overall security posture to technical and non-technical audiences.

Security Visibility & Reporting

• Aggregate vulnerability data from multiple scanning tools and sources into a coherent, unified view of security risk.

• Develop and maintain metrics and KPIs that enable leadership visibility into ongoing security exposure and program effectiveness.

• Present findings, trends, and recommendations in written reports, executive briefings, and team meetings.

Collaboration & Process Improvement

• Act as a liaison between the security team and remediation owners, facilitating communication and removing blockers to resolution.

• Continuously improve vulnerability management workflows, tooling, and documentation.

• Support audit and compliance activities by providing evidence of vulnerability tracking and risk treatment processes.

• Contribute to threat intelligence efforts and stay current on emerging CVEs and attack trends relevant to the organization.

Qualifications Required

• 2+ years of experience in an information security, vulnerability management, or related role.

• Hands-on experience with vulnerability scanning platforms (e.g., Tenable, Qualys, Rapid7, Wiz, or similar).

• Solid understanding of CVSS scoring, vulnerability classification, and risk-based prioritization.

• Experience communicating security findings and risk to both technical teams and business stakeholders.

• Familiarity with common compliance and risk frameworks (e.g., NIST CSF, ISO 27001, SOC 2).

• Familiarity with GovTech's IM8 (Instruction Manual 8) policies and its associated risk-based assessment methodology, including the application of controls, classification of government ICT systems, and conducting or supporting IM8-aligned security reviews.

• Strong organizational skills with the ability to manage multiple workstreams and deadlines simultaneously.

Preferred

• Relevant certifications such as CompTIA Security+, CEH, GWAPT, or equivalent.

• Experience with ticketing and workflow tools (e.g., Jira, ServiceNow) for tracking remediation.

• Scripting or automation skills (Python, Bash) to support data aggregation and reporting workflows.

• Background in cloud security environments (AWS, Azure, GCP).

OpenSource Pte Ltd, headquartered in Singapore, operates as a private limited company. The primary thrust of our enterprise centers on the realm of IT infrastructure. Our expertise lies in executing intricate IT systems and application integration within diverse and multifaceted environments. Proficiency in managing a wide array of Operating Systems, Front Ends, Middleware, and Databases is intrinsic to our skill set.

What truly sets us apart is our knack for providing comprehensive turnkey IT solutions, encompassing every facet from conception and design to implementation, coexistence, rectification, and ongoing annual maintenance. Rather than limiting ourselves to a specific business vertical, our capabilities span across industries, rendering our solutions universally applicable.