DevSecOps Specialist, Technology Information Security Office

OCBC Bank; Singapore; On-site; SGD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive base salary

Holistic benefits package

Learning & development opportunities

Job summary

OCBC Bank is seeking a Cyber Engineering - Risk professional to safeguard systems and networks, collaborating with DevOps to identify and mitigate cyber threats. You will develop security strategies, train developers, and design automated checks within CI/CD.

Required are 5+ years in cyber security, knowledge of SAST/DAST/IAST, and strong communication skills. Familiarity with MAS TRMG and PCI-DSS is preferred. Banking experience in Singapore is highly valued.

Qualifications

• Minimum 5 years of cyber security experience.
• Familiarity with MAS TRMG, PCI-DSS and other regulatory requirements.
• Certifications such as GWAPT, OSCP, CISSP are preferred.
• Experience with DevSecOps for banks in Singapore is highly preferred.
• Able to communicate effectively with various stakeholders.

Responsibilities

• Evaluate threat, vulnerability, impact, and risk from security issues across DevSecOps tools.
• Advise DevOps teams on security issues and remediation strategies.
• Develop and implement DevSecOps metrics, policies, and processes.
• Provide training on tool usage to developers and stakeholders.
• Assist with automating security checks in CI/CD pipelines.
• Review and triage vulnerabilities detected by tools.
• Liaise with vendors and manage incidents related to security tools.
• Stay current on industry trends and advocate security improvements.

Skills

Threat analysis

Security risk assessment

DevSecOps

SAST SCA IAST DAST

Container security

CI/CD pipelines

Scripting (Python/Bash/JavaScript)

Communication skills

Analytical thinking

Regulatory familiarity (MAS TRMG, PCI‑

Education

Bachelor’s degree in CS/Engineering/IT

Tools

SAST tools

SCA tools

DAST/IAST tools

CI/CD tooling

Container scanning (Docker)

Job description

WHO WE ARE

As Singapore’s longest established bank, we have been dedicated to enabling individuals and businesses to achieve their aspirations since 1932. How? By taking the time to truly understand people. From there, we provide support, services, solutions, and career paths that meet their individual needs and desires. Today, we’re on a journey of transformation. Leveraging technology and creativity to become a future-ready learning organisation. But for all that change, our strategic ambition is consistently clear and bold, which is to be Asia’s leading financial services partner for a sustainable future. We invite you to build the bank of the future. Innovate the way we deliver financial services. Work in friendly, supportive teams. Build lasting value in your community. Help people grow their assets, business, and investments. Take your learning as far as you can. Or simply enjoy a vibrant, future-ready career. Your Opportunity Starts Here.

Why Join

Protecting our customers' assets and data is at the heart of everything we do at OCBC. As a Cyber Engineering - Risk professional, you'll play a critical role in safeguarding our systems and networks from cyber threats. You'll be part of a team that's shaping the future of cybersecurity in the financial industry. To succeed in this role, you'll need to stay one step ahead of emerging threats. You'll work closely with our engineering teams to identify and mitigate risks, and develop strategies to protect our systems and data. You'll need to be proactive, collaborative, and always looking for ways to improve our cybersecurity posture.

What you do

• Evaluate and analyse threat, vulnerability, impact, and risk of security issues discovered from various DevSecOps tools such as Static Application Security Testing (SAST), Software Composition Analysis (SCA), Interactive Application Security Testing (IAST), Dynamic Application Security Testing (DAST)and Container Security platform.
• Advise and collaborate with DevOps teams, developers, application, and project teams on the security issues, including explanation of the technical details and how they can remediate the vulnerabilities in their applications.
• Develop and design DevSecOps metrics, policies, processes, and procedures.
• Provide training to developers and other stakeholders on the usage of the tools.
• Assist with implementing and designing automated security checks and additional security tools within the CI/CD pipelines.
• Review and triage vulnerabilities discovered by automated security tools.
• Proficient understanding of programming languages.
• Proficiency in scripting (Python, Bash, Javascript or similar) to support the automation and continuous improvement of processes.
• Knowledge in build/release tools and methodologies in CI/CD pipelines.
• Conduct POCs and work with vendors for DevSecOps tools to achieve security automation and efficiency.
• Liaise with external vendors and oversee the resolution of incidents and technical issues related to the security tools.
• Effectively communicate and manage expectations of various stakeholders.
• Keep abreast of the latest industry trends in security and DevSecOps processes and make continuous recommendations for improvement.

Who you are

• Minimum 5 years of cyber security experience.
• Sound technical background of working with SAST, SCA, DAST, IAST and other vulnerability scanning tools.
• Prior experience in performing secure code reviews, web and mobile application penetration tests.
• Solid understanding of full DevSecOps pipeline, Agile methodology, cloud security, APIs and microservices.
• Deep knowledge of container security(Docker image scanning) and related vulnerabilities.
• Knowledge in IaC (Infrastructure as Code) security.
• Automate security validation in CI/CD pipeline for IaC deployments.
• Capable of working with various CI/CD tools.
• Analytical thinker with excellent communication skills.
• A recognized university degree in Computer Science, Computer/Electrical Engineering, Information Technology or equivalent.
• Familiarity of MAS TRMG, PCI-DSS and other regulatory/industries requirements.
• Possesses certifications in cyber security field such as GWAPT, OSCP, CISSP etc.
• Experience working in DevSecOps for Banks in Singapore will be highly preferred.
• Good communication (spoken and written) skills, able to work independently and as a team.

What we offer

• Competitive base salary.
• A suite of holistic, flexible benefits to suit every lifestyle.
• Community initiatives.
• Industry-leading learning and professional development opportunities.
• Equal opportunity.
• Fair employment.
• Selection based on ability and fit with our culture and values.
• Your wellbeing, growth and aspirations are every bit as cared for as the needs of our customers.

Who we are

As Singapore's longest established bank, we have been dedicated to enabling individuals and businesses to achieve their aspirations since 1932. How? By taking the time to truly understand people. From there, we provide support, services, solutions, and career paths that meet their individual needs and desires. Today, we're on a journey of transformation. Leveraging technology and creativity to become a future-ready learning organisation. But for all that change, our strategic ambition is consistently clear and bold, which is to be Asia's leading financial services partner for a sustainable future. We invite you to build the bank of the future. Innovate the way we deliver financial services. Work in friendly, supportive teams. Build lasting value in your community. Help people grow their assets, business, and investments. Take your learning as far as you can. Or simply enjoy a vibrant, future-ready career. Your Opportunity Starts Here.

What we offer

• Competitive base salary.
• A suite of holistic, flexible benefits to suit every lifestyle.
• Community initiatives.
• Industry-leading learning and professional development opportunities.
• Your wellbeing, growth and aspirations are every bit as cared for as the needs of our customers.

Company Overview

As the longest established Singapore bank, formed in 1932 from the merger of three local banks, we have grown from strength to strength to become a regional financial services group. With a deep history in Asia, we offer the most comprehensive coverage across ASEAN and Greater China, complemented with a presence in the leading economies of New York, London and Sydney. We are the second largest financial services group in Southeast Asia by assets with one of the world’s highest credit rating (Aa1 by Moody’s and AA- by both Fitch and S&P). We offer private banking services through our wholly-owned subsidiary, Bank of Singapore, which operates on a unique open-architecture product platform to source for the best-in-class products to meet its clients’ goals. Our insurance subsidiary, Great Eastern Holdings, is the oldest and most established life insurance group in Singapore and Malaysia.

Our Mission

Let’s build the bank we need for the future we want. Find the best version of yourself in a friendly, supportive team. Build lasting value in your community. Help people grow their assets, business, and investments. Take your learning as far as you can. Or simply enjoy a vibrant, future-ready career. Your Opportunity Starts Here