Compliance Manager

ONESECURE ASIA PTE. LTD.; Singapore; On-site; SGD 80,000 - 120,000; Full time

Job summary

A cybersecurity firm in Singapore is seeking a technically strong Compliance professional to lead their governance, risk, and compliance program. You will be responsible for the end-to-end lifecycle for ISO27001 and SOC2, drive control design and testing, and ensure alignment with local regulations. The ideal candidate will have significant experience in cybersecurity governance and a thorough understanding of compliance frameworks. This role involves collaboration with engineering to embed security into development processes.

Qualifications

• Strong experience in cybersecurity governance and compliance.
• Familiarity with Singapore regulatory frameworks and standards.
• Proven leadership skills in managing compliance and risk.

Responsibilities

• Lead and mature cybersecurity governance, risk, and compliance program.
• Define policies and maintain ISMS scope and control baseline.
• Conduct risk assessments and coordinate audits.
• Design and implement technical controls with engineering teams.
• Oversee third-party risk management and supplier due diligence.

Skills

Cybersecurity governance

Risk management

Compliance frameworks (ISO27001, SOC2)

Data Protection Trustmark

Technical controls

Job description

Role Summary

We’re looking for a technically strong Compliance professional to lead and mature our cybersecurity governance, risk, and compliance program. You will own the end-to-end lifecycle for ISO27001 and SOC2, drive control design and testing across cloud and on‑prem environments, and partner with engineering to embed security-by-design. Experience with Singapore frameworks such as the Cyber Trust Mark, Data Protection Trustmark (DPTM), and ISO42001 (AI Management System) is a strong advantage.

Key Responsibilities

ISO27001 (ISMS)

• Define and maintain ISMS scope, risk methodology, Statement of Applicability, and control baseline.
• Lead risk assessments, treatment plans, and ongoing control performance monitoring.
• Establish policy framework (security, access control, asset, cryptography, operations, supplier, incident, business continuity).
• Plan and execute internal audits; coordinate external certification audits and surveillance audits.
• Drive corrective and preventive actions (CAPA) and continual improvement.

SOC2 (Type I & II)

• Map Trust Services Criteria (security, availability, confidentiality; privacy and processing integrity where applicable) to technical and operational controls.
• Orchestrate readiness assessments, evidence collection, control testing, and audit facilitation.
• Implement robust evidence management, logging, monitoring, and exception handling processes.
• Align system description, complementary user entity controls (CUECs), and subservice organization monitoring.

Singapore Regulatory & Trust Marks (Added Advantage)

• Cyber Trust Mark (CSA): Lead gap assessments, control implementation, and attestation readiness.
• DPTM (PDPC): Align data protection controls to PDPA, privacy governance, DPIAs, consent/notification, retention, and data subject rights processes.
• ISO42001 (AI MS): Support AI governance (policy, risk, data quality, model lifecycle, bias/ethics, transparency), control testing, and audit preparation.

Technical Compliance & Control Assurance

• Translate security requirements into technical controls (cloud, network, identity, endpoint, data protection).
• Partner with engineering/DevOps to embed controls in CI/CD, IaC, containers/Kubernetes, and SDLC (secure design, code review, dependency/vuln management).
• Operate/assess logging, SIEM use cases, alerting, and incident response playbooks.
• Run continuous control testing, vulnerability management (scanning, remediation SLAs), and configuration baselines (CIS, benchmarks).
• Oversee third-party risk management, DPAs, and supplier due diligence

Governance, Risk & Training

• Own the GRC roadmap, risk register, metrics (KRI/KPI), and compliance dashboarding.
• Lead awareness and role-based training; drive a culture of compliance and security‑by‑design.
  Prepare concise executive reports and findings for leadership and stakeholders.