Cybersecurity Consultant (AppSec, VAPT & DevSecOps)

SEDHA CONSULTING PTE. LTD.; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

SEDHA CONSULTING PTE. LTD. seeks a security testing leader to define a ministry-wide VAPT framework, develop SOPs for vendor engagement, and implement quality rubrics across testing efforts.

You will guide architecture reviews, advise on security requirements, and drive secure development practices using OWASP/SANS guidelines, SAST/DAST tools, and threat-management analytics.

Qualifications

• Degree in Computer Science, Computer Engineering, Electronics or Information Technology.
• Minimum 3 years of IT security experience in security operations and testing.
• Proven track record in conducting penetration tests for Web Applications, IT systems and complex networks.
• Ability to communicate cyber risks, mitigations and residual risks to stakeholders.
• Knowledge of cloud/on-prem security technologies, SIEM, firewalls, cryptography, and vulnerability tools.
• Proficiency with SAST/DAST/SCA tools like Checkmarx, Fortify, SonarQube, Snyk, Burp Suite.
• Familiarity with DevSecOps practices and secure coding concepts.
• OSCP/SSCP/GDSA or related certifications are advantageous.

Responsibilities

• Establish Standards for a ministry-wide security testing framework (VAPT).
• Develop SOPs to guide agency projects on engaging external vendors and testing cycles.
• Create Quality Rubrics; sample testing reports to ensure quality across the ministry family.
• Support security tools (CSPM, VMS) and coordinate remediation activities.
• Advise on agency-specific security requirements and architecture to meet security policies.
• Establish ministry-wide secure coding guidelines (OWASP, SANS).
• Lead strategy for SAST and SCA; evaluate automation tools for source code security.
• Participate in scoping, facilitating security assessments, reviews and audits; ensure risk is managed before commissioning.

Skills

Penetration testing

Web applications

Cloud security

Vulnerability assessment (VAPT)

Security assessment

Communication with stakeholders

Education

Bachelor's degree in Computer Science or related field

Tools

Checkmarx

Fortify

SonarQube

Snyk

Burp Suite

Job description

General Responsibilities

• Establish Standards: Define and maintain the Ministry-wide framework for security testing (Vulnerability Assessment and Penetration Testing - VAPT).
• SOP Development: Create and roll out Standard Operating Procedures (SOPs) to guide Agency project teams on engaging external security vendors and managing internal testing cycles.
• Quality Assurance: Develop "Quality Rubrics" to help agencies evaluate the performance of pen-testers. You will conduct periodic sampling of testing reports and project involvements to ensure quality and rigour across the Ministry Family.
• Support security tools such as CSPM, VMS, etc and follow up as part of remediation.
• Assisting in the development of agency-specific security requirements, reviewing and providing consultancy on the project-specific application and system security architecture to ensure that key security requirements are defined and designed into the systems, implemented in accordance to the security design, and in compliance with prevailing ICT security policies, standards, and guidelines.
• Secure Coding Standards: Establish Ministry-wide secure coding guidelines (e.g., based on OWASP, SANS) to ensure developers build security into the application layer from day one.
• Source Code Analysis: Lead the strategy for Static Application Security Testing (SAST) and Software Composition Analysis (SCA). You will evaluate tools that automate the detection of vulnerabilities in source code and third-party libraries.
• Participating in scoping and facilitating of security assessments, reviews and audits, as well as reviewing their results, ensuring issues identified are adequately resolved and residual risks appropriately managed to ensure security assurance prior to commissioning.
• Staying updated on current and emerging security technologies for cloud platforms like AW, as well as tracking the evolving threat landscape, including threat actors and attack methodologies to support agencies' gap analysis and threat management.
• Partnering with stakeholders, project teams, and outsourced vendors to ensure security objectives are achieved.

Qualifications, Skills and Mindset

• General Requirements:Degree in Computer Science, Computer or Electronics Engineering or Information Technology or related disciplines.
• Minimum 3 years of IT security experience in IT security operations, including management, deployment, and maintenance of security for ICT systems.
• Domain Expertise: Proven track record in conducting penetration tests for Web Applications, IT Systems (cloud environments), and complex Network architectures.
• Ability to effectively communicate cybersecurity risks, mitigation measures, and residual risks to stakeholders.
• Knowledge of cloud and on-premises security technologies, such as SIEM, Log Management and Analysis Tools, firewall, cryptography, vulnerability scanning tools, endpoint security, identity and access management, as well as frameworks like the MITRE ATT&CK framework, and security domains including data security, network security, cloud security, and application security.
• Source Code Analysis Tools: Proficiency with enterprise-grade SAST, DAST, SCA and VAPT tools (e.g., Checkmarx, Fortify, SonarQube, Snyk, Burp Suite).
• Familiarity with application security tools for testing, such as vulnerability assessment, penetration testing (VA/PT), source code reviews, and static/dynamic application security tests, as well as concepts of waterfall and agile application development methodologies, and DevSecOps concepts.
• Day to day security operations support as L2.
• Team player with good interpersonal skills.
• Possess good written, verbal, and presentation skills.
• Possess any of OSCP, SSCP, GDSA, Cloud Security, or related certifications would be advantageous.