AI-Driven GRC Cybersecurity Engineer

Assurity Trusted Solutions; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

Assurity Trusted Solutions (ATS) is a GovTech-backed entity seeking an experienced governance and risk professional to shape automation and security-control implementations. You will design SSP automation, map controls, and drive evidence-driven governance across products within scope.

As part of the CISO Office, you will define monitoring approaches, translate clauses into actionable requirements, and maintain dashboards and evidence for audits.

Qualifications

• Security frameworks or standards such as ISO 27001, NIST CSF, NIST SP 800-53, CSA CCM or equivalent control frameworks.
• Governance tooling, GRC platforms, evidence repositories, dashboards or workflow automation.
• Cloud and software-as-a-service (SaaS) security controls, identity and access management, logging, data protection and software-development lifecycle practices.
• Certifications are useful but do not replace practical judgement.

Responsibilities

• Design and operate AI-assisted automation for System Security Plan(SSP) review, evidence classification, control mapping, compliance monitoring and security-posture reporting.
• Define appropriate human review points and validate the reliability of automated outputs.
• Write, review and maintain practical security policies, standards and implementation guidance. Policies must translate organisational intent into clear, technically meaningful and enforceable requirements that product and engineering teams can apply.
• Own and improve the CISO Office's governanceand compliance monitoring approach, including the definition of what good security control implementation looks like for products within scope.
• Strengthen SSP verification by translating broad or process-oriented clauses into specific, testable control statements and evidence expectations that product teams can understand and apply.
• Coordinate Information and Communications Technology (ICT) risk management activities, including risk identification, treatment tracking, escalation, acceptance and formal closure, with clear ownership and due dates.
• Develop and maintain security posture reporting and the CISO dashboard, ensuring that reported status is supported by current evidence and highlights material gaps, trends and overdue actions.
• Establish repeatable timelines and evidence requirements for audit follow-up, compliance reviews, lower-level checks and other governance activities arising from previous assessments.
• Support the rollout and operationalisation of policies for AI-assisted coding, sensitive or high-impact data handling, software as a service (SaaS) usage, Model Context Protocol (MCP) integrations, logging and related emerging technology risks.
• Work with security and engineering teams to identify opportunities for compliance monitoring, workflow automation and agent-assisted evidence review while retaining human judgement for risk decisions and closure.
• Coordinate governance forums and working sessions with product teams and central stakeholders, ensuring decisions, actions, exceptions and dependencies are recorded and followed through.
• Maintain reusable governance guidance, control interpretations, evidence examples and lessons learned to improve consistency across future SSP and risk reviews.
• Provide concise, decision-ready advice to CISO leadership on systemic control gaps, resource constraints, residual risk and priorities for remediation.

Skills

Governance

Risk management

Stakeholder management

Security policy writing

Education

CISSP

CISA

CRISC

ISO 27001 Lead Implementer

Tools

GRC platforms

Dashboards

Cloud security controls

IAM

Job description

Assurity Trusted Solutions (ATS) is a GovTech-backed entity seeking an experienced governance and risk professional to shape automation and security-control implementations. You will design SSP automation, map controls, and drive evidence-driven governance across products within scope.

As part of the CISO Office, you will define monitoring approaches, translate clauses into actionable requirements, and maintain dashboards and evidence for audits.