Compliance Manager

ONESECURE Asia Pte Ltd; Singapore; On-site; SGD 80,000 - 120,000; Full time

Job summary

A cybersecurity firm in Singapore is seeking a strong Compliance professional to lead their cybersecurity governance and compliance program. You will own the lifecycle for ISO27001 and SOC2, drive control design, and collaborate with engineering for security integration. Ideal candidates will have experience with Singapore frameworks such as Cyber Trust Mark and Data Protection Trustmark. This role offers an opportunity to significantly enhance the firm's compliance posture.

Qualifications

• Strong experience in leading cybersecurity governance, risk, and compliance.
• Familiarity with frameworks like Cyber Trust Mark and Data Protection Trustmark.
• Technical background with ISO27001 and SOC2.

Responsibilities

• Define ISMS scope and lead risk assessments.
• Drive internal and external audit processes.
• Implement technical controls in cloud and on-prem environments.
• Partner with engineering to embed security in CI/CD.

Skills

Cybersecurity governance

Risk management

Compliance with ISO27001

Knowledge of Singapore frameworks

Job description

Role Summary

We’re looking for a technically strong Compliance professional to lead and mature our cybersecurity governance, risk, and compliance program. You will own the end-to-end lifecycle for ISO27001 and SOC2, drive control design and testing across cloud and on‑prem environments, and partner with engineering to embed security-by-design. Experience with Singapore frameworks such as the Cyber Trust Mark, Data Protection Trustmark (DPTM), and ISO42001 (AI Management System) is a strong advantage.

Key Responsibilities

ISO27001 (ISMS)

• Define and maintain ISMS scope, risk methodology, Statement of Applicability, and control baseline.
• Lead risk assessments, treatment plans, and ongoing control performance monitoring.
• Establish policy framework (security, access control, asset, cryptography, operations, supplier, incident, business continuity).
• Plan and execute internal audits; coordinate external certification audits and surveillance audits.
• Drive corrective and preventive actions (CAPA) and continual improvement.

SOC2 (Type I & II)

• Map Trust Services Criteria (security, availability, confidentiality; privacy and processing integrity where applicable) to technical and operational controls.
• Orchestrate readiness assessments, evidence collection, control testing, and audit facilitation.
• Implement robust evidence management, logging, monitoring, and exception handling processes.
• Align system description, complementary user entity controls (CUECs), and subservice organization monitoring.

Singapore Regulatory & Trust Marks (Added Advantage)

• Cyber Trust Mark (CSA): Lead gap assessments, control implementation, and attestation readiness.
• DPTM (PDPC): Align data protection controls to PDPA, privacy governance, DPIAs, consent/notification, retention, and data subject rights processes.
• ISO42001 (AI MS): Support AI governance (policy, risk, data quality, model lifecycle, bias/ethics, transparency), control testing, and audit preparation.

Technical Compliance & Control Assurance

• Translate security requirements into technical controls (cloud, network, identity, endpoint, data protection).
• Partner with engineering/DevOps to embed controls in CI/CD, IaC, containers/Kubernetes, and SDLC (secure design, code review, dependency/vuln management).
• Operate/assess logging, SIEM use cases, alerting, and incident response playbooks.
• Run continuous control testing, vulnerability management (scanning, remediation SLAs), and configuration baselines (CIS, benchmarks).
• Oversee third-party risk management, DPAs, and supplier due diligence

Governance, Risk & Training

• Own the GRC roadmap, risk register, metrics (KRI/KPI), and compliance dashboarding.
• Lead awareness and role-based training; drive a culture of compliance and security‑by‑design.
  Prepare concise executive reports and findings for leadership and stakeholders.