Description
GovTech is the lead agency driving Singapore’s Smart Nation initiatives and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (ICT & SS), GovTech develops the Singapore Government’s capabilities in Data Science & Artificial Intelligence, Application Development, Smart City Technology, Digital Infrastructure, and Cybersecurity.
Play a part in Singapore’s vision to build a Smart Nation and embark on your meaningful journey to build tech for public good. Join us to advance our mission and shape your future with us today!
The Government Commercial Cloud (GCC) Engineering team develops platform automations, landing zones, and security tooling across AWS, Azure, and GCP , serving thousands of government systems and thousands of public officers. Security at GCC is not a side function , it's core to the platform's value proposition. Government agencies trust GCC to be secure by default.
As the Lead Cybersecurity Engineer, you are the single named owner of security outcomes across all engineering teams in GCC. You define how security works , the standards, processes, escalation paths, and technical approaches , and drive adoption through influence, not authority. You operate through a Security Champions network: persistent, named engineers in each product team who own security judgment locally, coordinated by you. Your accountability is whether GCC is actually secure , measured through process health, incident response quality, and security posture metrics you define.
Security Architecture & Posture
- Own the organisation's security posture across all product teams and cloud environments
- Architect security frameworks that integrate into engineering workflows without creating bottlenecks
- Design and evolve threat modelling methodologies adapted to the organisation's multi-cloud, multi-tenant context
- Define escalation paths, severity frameworks, and incident response playbooks
- Own the relationship with GCSOC, shaping how external security signals translate into internal action
- Drive security tooling strategy , selecting, configuring, and setting alert thresholds that distinguish signal from noise
Standards & Process Design
- Define security standards, runbooks, and compliance approaches that teams can self-serve against
- Design the Security Champions model: training curriculum, forum cadence, escalation criteria, and what "good" looks like for a champion
- Replace gatekeeping with enablement , move from "security reviews everything" to "teams self-certify against clear criteria, you spot-check and consult"
- Own security decision records: all posture choices documented, auditable, and transferable
- Reform compliance processes (e.g. IMR8) to reduce ceremony while maintaining assurance
Cross-Org Influence
- Drive security adoption across 5-6 engineering teams through the Champions network
- Run a regular cross-org security forum: shared learning, emerging threats, pattern reviews
- Consult on high-risk designs and architectural trade-offs when teams escalate
- Handle genuine security incidents personally, with Champions as informed participants
- Build security judgment across the engineering organisation , not by centralising decisions, but by raising the floor
- Serve as the organisation's authoritative security voice on technical matters , advising on vendor evaluations, platform-level policy design, and cross-programme security decisions that require deep domain expertise beyond any single team's scope
Technical Depth
- Maintain hands-on capability in at least two of: cloud security architecture, application security, supply chain security, detection engineering
- Evaluate and prototype security tooling; make build-vs-buy recommendations grounded in the org's actual threat model
- Contribute to or lead security incident post-mortems with root cause analysis that drives systemic improvement
- Stay current on emerging threats and translate external signals into organisational action