Consultant-Governance, Risk and Compliance Specialist
Job Description
Develop the culture of Tech risk governance and management across the organisation, and ensure proper accountability in the management, tracking and reporting of tech and cyber risks.
Provide subject matter advice to internal stakeholders on cyber security requirements that the Authority is required to comply with, including Client’s internal policies and standards, as well as policies and standards from GovTech and Cyber Security Agency of Singapore.
Review and establish ICT policies and process controls and conduct compliance checks.
Support team lead and work with internal stakeholders to:
Track and monitor tech projects and initiatives to meet compliance requirements.
Track and monitor of Key Risk Indicators and Control Self-Assessment as part of Tech governance framework.
Track and monitor incident reporting, including reviewing, monitoring, and reporting on the corrective measures and improvement areas.
Participate in consultation and conduct gap analysis against new or revised requirements.
Assess and seek waiver approvals for deviations and risk treatment strategies.
Coordinate and facilitate IT / cyber security audits.
Track remediation plans to address audit findings.
Follow up on remediation actions, security and risk assessments with respective stakeholders and project and application managers.
Work with Application System Managers to maintain a high degree of operating hygiene such as assisting in annual password change, assess and resolve vulnerabilities in security scans, vulnerabilities in penetration testing, OS patching, etc.
Collaborate with Application System Managers to conduct risk assessment for the applications within the divisions; ensuring they adhere to the Instruction Manual 8 and applicable cyber clauses.
Recommend the re-engineering and streaming of processes to enhance effectiveness of controls implemented.
Present management reporting to stakeholders, with analysis of data and trends, and recommend next steps.
Enhance training and other materials in ICT risk management, document case studies and good practices.
Job Requirement
At least 5 years relevant experience in ICT cybersecurity, data security, audit management, governance, risk and compliance management
Relevant certifications in IT governance, IT audit, cyber or data security (e.g. CISSP, CISM, CISA,etc.) preferred.
Ability to work with cross-functional,multi-disciplined team to operationalise monitor security policies and procedures.
Knowledge of Instruction Manual 8 and CSA Cybersecurity Code of Practice preferred.
Technical knowledge of security vulnerabilities, validation of remediations and risk assessments.
Relevant experience in data visualisation and analytics.
