Cybersecurity Engineer (GRC Manager)

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

Responsibilities:

GRC leadership & 2nd line of defence

• Act as thede facto lead for GRC, shaping how we govern risk and compliance across managed products and platforms within the team’s remit.
• Operate as2nd line of defencefor ICT risk and controls providingindependent challengeon risk, control design, and effectiveness.
• Partner closely withProduct teamto embed pragmatic security and compliance into day-to-day delivery.

Security Plan governance and automation

• Own thegovernance and standards for Security Plan submissionsacross CIOO and product teams – including templates, minimum evidence expectations, and quality benchmarks.
• Review Security Plans and supporting evidence, assess control coverage and implementation maturity, andRecommendation of Security Plan approvals to the stakeholders.
• Treatautomation as an “always-on audit”:

• Collaborate with product and platform teams to define the Security Plan evidence that should be checked automatically.
• Use automated checks to surface gaps, anomalies, and missing evidence, and drive remediation with product teams.

• Track and reportKPIs for Security Plan(e.g. coverage and consistency of controls, Security Plan cycle time, defect rates) across CIOO and product teams.

ICT audit and evidence management

• Design, implement, and own workflowsfor ICT audit, risk, and findings management.
• Structure and maintain knowledge and documentation spacesas the source of truth for:
• ICT audit plans, scopes, and procedures
• Control descriptions and standard evidence templates
• Central repositories of audit evidence and Security Plan artefacts

• Plan and executethematic and product-level ICT auditsunder the CISO’s direction, independently assessing:
• Whether required work has been completed
• Whether evidence provided by product teams is sufficient and reliable

• Coordinate withinternal audit (3rd line)on ICT/security audit engagements, facilitate evidence collection, andtrack closure of findingsin the issue-tracking system.
• Provide regularmanagement reportingon audit status, key risks, and trends to CIOO leadership and the CISO.

Security policy ownership

• Serve asauthor and custodianfor key GovTech-wide security and technology policies under CIOO’s remit, for example:
• Sandbox usage(development / test environments)
• AI codingpractices and guardrails
• SaaS usage, onboarding, and clearancerequirements

• Own thepolicy lifecycle: drafting, stakeholder consultation, impact assessment, approval routing, publication, and periodic review.
• Translate policy intoclear, practical guidancefor product teams (e.g. how to comply in the issue-tracking and collaboration platforms, what “good” evidence looks like, what patterns and exceptions are acceptable).
• Monitor policy adoption and escalate materialnon-compliance or risk acceptancesto the CISO where necessary.

Security Education, Training and Awareness (SeTA)

• LeadSeTA for GovTech HQin alignment with CIOO’s cyber strategy and policies.
• Design and runtargeted SeTA campaigns, including:
• Phishing simulationsand follow-up actions
• Security newsletterstailored to different audiences (e.g. tech vs non-tech)
• Brown-bag sessions / clinicsto deep-dive into topics like SaaS usage, sandboxing, secure coding, and incident reporting.

• Define and trackSeTA KPIs(e.g. phishing susceptibility, completion rates, engagement metrics) and use insights to continually refine content and focus areas.

Change management & stakeholder engagement

• Champion a“new way of doing audit and GRC”using:
• standard issue-tracking and collaboration tools as the primary systems of record for audit and evidence
• automated controls and analytics for continuous, data-driven assurance

• Influence andnegotiate with senior stakeholders(Product Directors, Application Owners, central functions) to adopt and sustain these new practices.
• Communicate complex policy and risk topics inclear, outcome-focused language, tailored to both technical and non-technical audiences.
• Provide clear, actionable recommendations to theCISO and CIOO leadershipon risk, remediation priorities, and structural improvements.

Requirements

• At least5 years of experience in Cybersecurity, preferably in a regulated or public-sector environment.
• Strong understanding of:
• ICT governance and security controlsacross applications, infrastructure, and SaaS
• Howproduct teamswork (SDLC, agile delivery, cloud/SaaS usage) and where to embed controls without blocking delivery.

• Comfortable acting as2nd line of defence– providing independent challenge, validating evidence, and working constructively with 1st line teams and 3rd line internal audit.
• Practical experience withenterprise issue-tracking and collaboration platforms:
• Designing or maintaining workflows, issue types, and dashboards for audit, risk, or compliance
• Structuring spaces/pages for policies, standards, and evidence repositories

• Strongpolicy writing skills– able to draft clear, concise policies and standards, and translate them into playbooks, checklists, and working-level guidance.
• Experience insecurity awareness and training:
• Designing or running phishing simulations
• Producing newsletters or comms
• Delivering talks or briefings is a plus.

• Comfortable working withautomation and AI-enabled tools(such as enterprise search platforms) to scale GRC and audit work.
• Excellentstakeholder management, influencing, and negotiationskills, with a track record of:
• Leading change in how teams work (e.g. moving to issue-tracking- and collaboration-based evidence and audit)
• Challenging assumptions respectfully
• Finding pragmatic, risk-aware compromises.

Join us and discover a meaningful and exciting career with Assurity Trusted Solutions!

The remuneration package will commensurate with your qualifications and experience. Interested applicants, please click "Apply Now".

We thank you for your interest and please note that only shortlisted candidates will be notified.

By submitting your application, you agree that your personal data may be collected, used and disclosed by Assurity Trusted Solutions Pte. Ltd. (ATS), GovTech and their service providers and agents in accordance with ATS’s privacy statement which can be found at:https://www.assurity.sg/or such other successor site.

Benefits

• A wholly-owned subsidiary of GovTech.
• We promote a learning culture and encourage you to grow and learn.
• Contract Staff enjoys the same benefits as Permanent Employees.