Cybersecurity Engineer (GRC with AI)

Assurity Trusted Solutions; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

Assurity Trusted Solutions (ATS) is a GovTech-backed entity seeking an experienced governance and risk professional to shape automation and security-control implementations. You will design SSP automation, map controls, and drive evidence-driven governance across products within scope.

As part of the CISO Office, you will define monitoring approaches, translate clauses into actionable requirements, and maintain dashboards and evidence for audits.

Qualifications

• Security frameworks or standards such as ISO 27001, NIST CSF, NIST SP 800-53, CSA CCM or equivalent control frameworks.
• Governance tooling, GRC platforms, evidence repositories, dashboards or workflow automation.
• Cloud and software-as-a-service (SaaS) security controls, identity and access management, logging, data protection and software-development lifecycle practices.
• Certifications are useful but do not replace practical judgement.

Responsibilities

• Design and operate AI-assisted automation for System Security Plan(SSP) review, evidence classification, control mapping, compliance monitoring and security-posture reporting.
• Define appropriate human review points and validate the reliability of automated outputs.
• Write, review and maintain practical security policies, standards and implementation guidance. Policies must translate organisational intent into clear, technically meaningful and enforceable requirements that product and engineering teams can apply.
• Own and improve the CISO Office's governanceand compliance monitoring approach, including the definition of what good security control implementation looks like for products within scope.
• Strengthen SSP verification by translating broad or process-oriented clauses into specific, testable control statements and evidence expectations that product teams can understand and apply.
• Coordinate Information and Communications Technology (ICT) risk management activities, including risk identification, treatment tracking, escalation, acceptance and formal closure, with clear ownership and due dates.
• Develop and maintain security posture reporting and the CISO dashboard, ensuring that reported status is supported by current evidence and highlights material gaps, trends and overdue actions.
• Establish repeatable timelines and evidence requirements for audit follow-up, compliance reviews, lower-level checks and other governance activities arising from previous assessments.
• Support the rollout and operationalisation of policies for AI-assisted coding, sensitive or high-impact data handling, software as a service (SaaS) usage, Model Context Protocol (MCP) integrations, logging and related emerging technology risks.
• Work with security and engineering teams to identify opportunities for compliance monitoring, workflow automation and agent-assisted evidence review while retaining human judgement for risk decisions and closure.
• Coordinate governance forums and working sessions with product teams and central stakeholders, ensuring decisions, actions, exceptions and dependencies are recorded and followed through.
• Maintain reusable governance guidance, control interpretations, evidence examples and lessons learned to improve consistency across future SSP and risk reviews.
• Provide concise, decision-ready advice to CISO leadership on systemic control gaps, resource constraints, residual risk and priorities for remediation.

Skills

Governance

Risk management

Stakeholder management

Security policy writing

Education

CISSP

CISA

CRISC

ISO 27001 Lead Implementer

Tools

GRC platforms

Dashboards

Cloud security controls

IAM

Job description

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

Responsibilities

• Design and operate AI-assisted automation for System Security Plan(SSP) review, evidence classification, control mapping, compliance monitoring and security-posture reporting.
• Define appropriate human review points and validate the reliability of automated outputs.
• Write, review and maintain practical security policies, standards and implementation guidance. Policies must translate organisational intent into clear, technically meaningful and enforceable requirements that product and engineering teams can apply.
• Own and improve the CISO Office's governanceand compliance monitoring approach, including the definition of what good security control implementation looks like for products within scope.
• Strengthen SSP verification by translating broad or process-oriented clauses into specific, testable control statements and evidence expectations that product teams can understand and apply.
• Coordinate Information and Communications Technology (ICT) risk management activities, including risk identification, treatment tracking, escalation, acceptance and formal closure, with clear ownership and due dates.
• Develop and maintain security posture reporting and the CISO dashboard, ensuring that reported status is supported by current evidence and highlights material gaps, trends and overdue actions.
• Establish repeatable timelines and evidence requirements for audit follow-up, compliance reviews, lower-level checks and other governance activities arising from previous assessments.
• Support the rollout and operationalisation of policies for AI-assisted coding, sensitive or high-impact data handling, software as a service (SaaS) usage, Model Context Protocol (MCP) integrations, logging and related emerging technology risks.
• Work with security and engineering teams to identify opportunities for compliance monitoring, workflow automation and agent-assisted evidence review while retaining human judgement for risk decisions and closure.
• Coordinate governance forums and working sessions with product teams and central stakeholders, ensuring decisions, actions, exceptions and dependencies are recorded and followed through.
• Maintain reusable governance guidance, control interpretations, evidence examples and lessons learned to improve consistency across future SSP and risk reviews.
• Provide concise, decision-ready advice to CISO leadership on systemic control gaps, resource constraints, residual risk and priorities for remediation.

Qualifications

Security frameworks or standards such as ISO 27001, NIST CSF, NIST SP 800-53, CSA CCM or equivalent control frameworks. Governance tooling, GRC platforms, evidence repositories, dashboards or workflow automation. Cloud and software-as-a-service (SaaS) security controls, identity and access management, logging, data protection and software-development lifecycle practices. Relevant professional certifications such as CISSP, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor. Certifications are useful but do not replace practical judgement.

Experience Technical security experience in cloud, application, infrastructure, platform, development, security and operations (DevSecOps), security architecture, security engineering or a closely related area, combined with experience in governance, risk or compliance. Strong understanding of how technical controls operate in practice, including identity and access management, logging and monitoring, vulnerability management, secure software delivery, cloud security and data protection. Ability to write clear, practical and enforceable control requirements, guidance and management papers for technical and non-technical stakeholders. Experience coordinating reviews across multiple products, platforms or business units, with the judgement to distinguish administrative completion from meaningful control effectiveness. Comfort working directly with cloud, software as a service (SaaS), software delivery and artificial intelligence (AI)-related risks. Experience with System Security Plans, threat modelling, AI governance, development, security and operations (DevSecOps), or automated compliance monitoring is advantageous. Strong stakeholder-management, facilitation and written-communication skills, with the ability to challenge constructively and drive actions to closure.

Join us and discover a meaningful and exciting career with Assurity Trusted Solutions! The remuner