AVP, Security Governance & Assurance

NETS; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

NETS in Singapore seeks an experienced information security professional to lead policy development, risk assessment and governance. You will enforce IS policies, coordinate audits and liaise with regulators to ensure strong cyber risk controls across payments-related environments.

You will collaborate with multiple stakeholders, drive data-driven risk reporting and support continuous improvement of security programs in a fast-paced financial services setting.

Qualifications

• Degree in Computer Science, Engineering or related with 8+ years in information security.
• Experience in security policy development, risk assessment, compliance & governance.

Responsibilities

• Manage IS related policies and enforce them across the organisation.
• Execute policies and controls to address IT and cyber risk from audits and process improvements.
• Partner with internal stakeholders to review and streamline cyber risk management processes.
• Reference regulator notices and guidelines to assess risk and close gaps with Tech teams.
• Prepare data for risk analysis and reporting to stakeholders.
• Communicate and provide guidance on new IS policies and standards to relevant teams.
• Manage IS audits and regulatory inspections; review findings and implement remedial actions.
• Liaise for IS audits, Risk and Compliance activities and support business audits with IS involvement.
• Manage audit lifecycle from kickoff to closure of findings, including follow-ups.
• Seek opportunities to innovate and automate security processes where appropriate.

Skills

Information security

Policy development

Risk assessment

Compliance monitoring

Governance

Security metrics (KRI)

Vulnerability management

Penetration testing findings

Security incident response

ISO27000/NIST

Cyber Hygiene

Regulatory compliance

Communication skills

Education

Degree in Computer Science, Engineering or related

8+ years in information security

Job description

• Responsible for the management and enforcement of IS related policies, processes and procedures.
• Execute policies, processes and procedures to facilitate effective IT and cyber related-risk Process and Control arising from Audit Findings or Process improvement maturity
• Partner and work with internal stakeholders to review, identify, streamline and implement process improvements with regards to Cyber risk management
• Reference to regulator’s notices, circulares and guidelines (such as, TRM, Cyber Hygiene) to assess risk and gaps, and work with Line 2 and Tech to improve policies and processes to mitigate risks, minimize their impact to operations
• Prepare and provide data for risk analysis and reporting.
• Communicate and provide guidance of new IS policies and standards to relevant stakeholders.
• Manage IS related audits, regulatory inspections. Review the audit findings with key stakeholders to determine audit findings root cause, formulate action plans accordingly and verify remedial solutions for closure
• Laision for IS audits, Risk and Compliance activities and providing support to business audits that have IS involvement.
• Manage audit lifecycle from start to end (eg kick off meeting, RFI, fieldwork, reporting and closure of audit findings).
• Ability to innovate and automate as required

Requirements

• Degree in Computer Science, Engineering or any other related disciplines with at least 8 years of progressive experience in Information security, including experience in security policy development, risk assessment, compliance implementation & monitoring and governance (preferably from financial/banking/payment industry
• Good working knowledge of enterprise security risk management methods and techniques to successfully deliver the security risk management and assessment outcome.
• Prior experience in implementing a program which includes the collation, management and reporting of security metrics (KRI) such as vulnerability management, open software security vulnerabilities, penetration testing findings, security alerts and incidents
• Experienced in information security frameworks including ISO27000 standard, NIST framework and regulations such as Cyber Hygiene Notice, Technology Risk Management Guidelines and Personal Data Protection Act.
• Ability to work in a team environment and work independently with minimal supervision and produce results that meet standards of quality, timeliness and acceptability
• Willingness to deep-dive and learn about the Information Security function within the payments domain
• Strong writing, communication and inter‐personal skills