Cyber Assurance Analyst

Maybank Singapore; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Maybank Singapore invites you to join as a Cyber Assurance Analyst to strengthen cyber resilience. You will independently assess controls, identify risk exposures, and support risk management with evidence-based reviews and AI-enabled monitoring.

Key responsibilities include thematic assurance across cyber and technology risk, independent challenge, and collaboration with diverse teams to drive remediation and governance improvements.

Qualifications

• Degree in Cyber Security, Information Security, Computer Science or related discipline.
• 4 to 10 years in two or more security domains listed in requirements.
• Experience assessing security control effectiveness and providing independent challenge.

Responsibilities

• Plan and execute thematic assurance reviews across cyber and tech risk domains.
• Design evidence-based validation activities to assess control design and operating effectiveness.
• Identify systemic control weaknesses and root causes.
• Develop AI-enabled continuous monitoring use cases for control testing.
• Collaborate with multiple stakeholders to enhance cyber resilience and governance.

Skills

Cyber Security Assurance

Threat Intelligence

Threat Hunting

Security Operations

Vulnerability Management

Information Security Governance

Incident Response

Analytical Thinking

Problem Solving

Communication Skills

Education

Degree in Cyber Security/Information Security/Computer Science

Job description

Join Maybank Singapore as a Cyber Assurance Analyst and help strengthen the Bank's cyber resilience in an increasingly complex threat environment. As part of our newly established Cyber Assurance & Emerging Threats Team, you will independently assess cyber and technology controls, identify emerging risk exposures, and provide objective challenge and assurance to support informed risk management and continuous improvement across the Bank.

As a Cyber Assurance Analyst, you will play a crucial role in enhancing the Bank's cyber resilience by assessing controls and identifying risks.

Responsibilities:-

A. Thematic Risk Assurance

• Plan and execute thematic assurance reviews across key cyber and technology risk domains, including, but not limited to cyber hygiene, identity and access management, vulnerability management, third-party security risk management, technology governance, cloud security, operational resilience, as well as other priority risk areas identified by management
• Design and execute evidence-based validation activities to assess control design and operating effectiveness through walkthroughs, document and configuration reviews, sampling and targeted controls testing against regulatory, industry and internal standards
• Identify systemic control weaknesses, recurring risk themes, and underlying root causes that may expose the Bank to elevated cyber or technology risks
• Develop and operationalise AI-enabled continuous monitoring use cases to automate control testing, detect control deviations and emerging risk indicators, and provide timely risk intelligence to management and governance committees
• Support continuous identification of control gaps, improvement opportunities, and emerging areas of concern.
• Assess whether existing controls remain effective against evolving threat actor tactics, emerging attack techniques and new technology risks
• Incorporate relevant cyber threat intelligence, industry incidents and regulatory developments into thematic assurance reviews
• Evaluate the Bank's preparedness against emerging risks including AI-enabled threats, third-party ecosystem attacks, cloud-native threats and identity-based attacks.

C. Independent Challenge and Validation

• Challenge assumptions in risk assessments, control evaluations, residual risk decisions and remediation strategies, while identifying blind spots and alternative risk perspectives
• Review responses to audit findings, regulatory observations and risk assessments; validate that action plans address the risk exposure and that completed remediation is effective and sustainable
• Assess whether accepted risks remain within the Bank's risk appetite and elevate significant or unresolved exposures through appropriate governance channels.

D. Root Cause and Systemic Risk Analysis

• Identify recurring findings and systemic weaknesses across technology domains and determine underlying root causes
• Assess whether recurring issues indicate broader governance, process, capability or cultural weaknesses.

E. Assurance Reporting, Governance & Remediation Oversight

• Produce concise, risk-focused and evidence-based assurance reports, dashboards and control health metrics, and present findings and thematic observations to senior management and governance committees
• Track management commitments and remediation activities through to closure
• Validate remediation effectiveness and sustainability
• Identify recurring issues and elevate significant concerns through governance channels.

F. Stakeholder Engagement

• Collaborate with Technology, Cyber Security, Control and Prevention, Risk Management, Internal Audit, Compliance, and business teams
• Promote a culture of strong risk management, continuous improvement, and cyber resilience.

Requirements:-

• Degree in Cyber Security, Information Security, Computer Science, Information Technology or a related discipline
• 4 to 10 years of experience in two or more of the following: Cyber Security Assurance, Threat Intelligence or Threat Hunting, Security Operations (SOC), Penetration Testing or Red Teaming, Security Architecture, Vulnerability Management, Information Security Governance, Cyber Risk Management, Incident Response, Cloud Security
• Proven experience assessing security control effectiveness, identifying control weaknesses, and providing independent challenge on cyber risk and remediation activities
• Experience within banking, financial services, critical infrastructure, or other highly regulated industries will be an advantage
• Strong risk and control mindset, with the ability to apply risk-based thinking in assessing control effectiveness and prioritising assurance activities
• Ability to provide constructive independent challenge while maintaining effective stakeholder relationships
• Strong analytical, investigative and problem-solving capabilities
• Excellent report writing, presentation and communication skills, with the ability to articulate complex technical and risk issues to both technical and non-technical audiences
• Highly organised, detail-oriented and evidence-driven, with a structured approach to assurance and risk assessment
• Self-motivated and able to thrive in environments requiring critical thinking, objectivity and sound judgement.

Preferred Skills

Strong understanding of the following: Cyber security control frameworks and best practices, including but not limited to:

• MAS Notice FSM-N06 Cyber Hygiene
• MAS Technology Risk Management Guidelines
• NIST Cybersecurity Framework
• CIS Controls
• ISO 27001
• COBIT
• Control Testing and Assurance Methodologies
• Regulatory Expectations within Financial Services
• Technology risk management principles
• Information security governance and control assurance
• Vulnerability management programmes
• Identity and access management controls
• Third-party risk management practices
• Security monitoring and incident management processes
• Cloud security and emerging technology risks.

Only shortlisted candidates will be notified.