# Senior Cybersecurity Governance Specialist **Company**: GovTech **Location**: Singapore **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Technology **Apply**: https://job-boards.greenhouse.io/govtech/jobs/4003957201?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_c951e5a1-1d0 ## Description GovTech is the lead agency driving Singapore's Smart Nation initiatives and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (ICT & SS), GovTech develops the Singapore Government's capabilities in Data Science & Artificial Intelligence, Application Development, Smart City Technology, Digital Infrastructure, and Cybersecurity. The Cyber Security Group (CSG) is the cybersecurity arm of GovTech. CSG is committed to create a digital government that is safe and secure. CSG delivers technical and operational capabilities to counteract cyber threats, provides thought leadership on transformative cybersecurity governance and policies and to strengthen the cybersecurity posture of government agencies in a manner that is sustainable, pragmatic, and effective. As a Senior Cybersecurity Governance Specialist, you will be the primary architect of the Ministry's security governance and risk management framework. You will ensure that all agencies within the Ministry Family operate under a unified, effective, and modern security standard. Your mission is to transform GRC from a compliance-heavy exercise into a strategic enabler. Key Responsibilities: - Establish and oversee the Ministry-wide security risk register - Lead and facilitate high-level risk conversations with Senior Management and Agency CIOs - Develop a robust framework to guide agencies in performing consistent, high-quality risk analysis - Establish and maintain Ministry-wide standards for conducting Threat Risk Assessments across diverse domains - Develop SOPs to guide agency project teams in identifying 'Crown Jewels' (Critical Information Assets) and mapping comprehensive threat vectors - Lead the establishment of a Ministry-wide Zero Trust Framework - Provide expert GRC input during the design phase of high-impact systems to ensure security-by-design and alignment with Ministry standards - Evaluate and recommend security technologies that effectively mitigate specific risks - Establish the framework for managing risks across the software supply chain and IT vendors - Shift agencies from 'reactive' audit preparation to a state of continuous compliance and readiness - Oversee the closure of audit findings, ensuring agencies implement substantive, effective technical fixes - Analyse audit trends across the Ministry Family to identify and address systemic weaknesses - Partner with Agency CIOs, CISOs, and Project Owners to inculcate a proactive risk management mindset - Keep abreast of evolving Actor TTPs (Tactics, Techniques, and Procedures) and technology changes Qualifications & Requirements: - 10 to 12 years in Cybersecurity GRC, Information Security Risk Management, or Security Architecture - Proven experience in managing risks across IT and Cloud environments; exposure to OT (Operational Technology) systems is a significant advantage - Deep familiarity with Singapore Government security policies and international standards - Mastery of risk assessment methodologies and the ability to translate technical vulnerabilities into business risk - Strong technical understanding of various Zero Trust Architecture (ZTA) components and cloud security technologies - Ability to map technical controls to the MITRE ATT&CK framework to ensure defensive coverage - Proficiency in manual and automated testing tools; deep understanding of the MITRE ATT&CK framework and common TTPs - Professional certifications such as CISM, CRISC, CISSP, OSCP or OSWE are highly preferred Soft Skills: - Ability to educate and persuade senior stakeholders on the importance of rigorous risk governance - Ability to look past surface-level audit compliance to find and fix underlying systemic issues - A genuine passion for staying updated on the latest security technologies and evolving cyber threat landscapes - Exceptional ability to 'translate' deep technical issues into business risk for non-technical senior executives ## Skills ### Required - Risk assessment methodologies - Zero Trust Architecture - Cloud security technologies - Threat Risk Assessments - GRC - Cybersecurity governance - Risk management - Security architecture ### Nice to have - CISM - CRISC - CISSP - OSCP - OSWE --- Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/govtech/jobs/4003957201?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)