Engineer - Senior Principal Engineer (Cyber Security Branch)

Energy Market Authority (EMA); Singapore; On-site; SGD 60,000 - 90,000; Full time

Job summary

Energy Market Authority (EMA) in Singapore leads regulatory oversight and cybersecurity assurance for the power sector’s Critical Information Infrastructure. The role focuses on assessing risks and coordinating remediation with CII owners, OT specialists, CSA and other agencies to strengthen cyber resilience.

You will review cybersecurity assessments, testing, and remediation plans, and participate in sector initiatives, regulatory implementations and incident preparedness.

Qualifications

• Strong understanding of cyber risk management, vulnerabilities and threats.
• Ability to analyse risks and collaborate with engineers for mitigations.
• Familiarity with vulnerability management, security testing or incident response is a plus.
• OT cybersecurity, CII protection and power-sector knowledge are advantageous.

Responsibilities

• Review cybersecurity risks, vulnerabilities, audit findings and remediation plans for power-sector CIIs.
• Assess cybersecurity measures implemented by CII owners, including OT environments.
• Conduct and support cybersecurity assurance activities and site visits.
• Review assessments and testing by CII owners and service providers; shape scope based on risks.
• Monitor significant findings and coordinate remediation with owners and stakeholders.
• Support regulatory requirements and national cybersecurity initiatives for the power sector.

Skills

Cybersecurity fundamentals

Risk assessment

Analytical & stakeholder management

Communication skills

Education

Cybersecurity or related field

Job description

[What the role is]

About the job

The key scope of work for the position is to support EMA’s role as Sector Lead for the power sector in the regulatory oversight and cybersecurity assurance of power-sector Critical Information Infrastructure (CII). This includes assessing cybersecurity risks and measures, reviewing cybersecurity assessments and testing, monitoring the remediation of significant cybersecurity findings, and supporting sector-level cybersecurity initiatives.

The position will also work with CII owners, technical specialists, the Cyber Security Agency of Singapore (CSA) and other stakeholders to strengthen the cyber resilience of Singapore’s power sector. The role provides opportunities to develop expertise in Operational Technology (OT) cybersecurity, CII regulation and power-sector cyber resilience.

[What you will be working on]

Cybersecurity Risk and Assurance

• Review cybersecurity risks, vulnerabilities, audit and assessment findings, and remediation plans of power-sector CIIs.
• Review and assess cybersecurity measures implemented by CII owners, including those relating to OT environments.
• Conduct and support cybersecurity assurance activities, including site visits to power-sector CII facilities, to assess cybersecurity measures and follow up on significant findings.
• Review cybersecurity assessments and testing undertaken by CII owners and their service providers, and work with technical specialists to shape the scope and focus of such activities based on identified risks.
• Monitor significant cybersecurity findings and work with CII owners and relevant stakeholders on appropriate remediation and risk mitigation measures.

Cybersecurity Regulatory and Sector Initiatives

• Support the implementation of cybersecurity regulatory requirements and national cybersecurity initiatives for the power sector.
• Monitor emerging cyber threats and technology developments and assess their potential implications for power-sector CIIs.
• Support cybersecurity exercises, incident preparedness and response, including coordination with CII owners, CSA and other relevant government agencies.
• Contribute to the development of cybersecurity policies and sector-level initiatives to strengthen the cyber resilience of Singapore’s power sector.

[What we are looking for]

Requirements:

• Relevant qualifications in cybersecurity, information security, computer science, computer engineering, electrical/electronic engineering or related fields.
• Preferably at least 2 years of relevant experience in cybersecurity, information security, technology risk, IT audit or related functions. Candidates with no prior experience but with relevant qualifications and a strong interest in cybersecurity are also welcome to apply.
• Good understanding of cybersecurity fundamentals, including cyber risk management, vulnerabilities, security controls and common cyber threats.
• Strong ability to analyse cybersecurity risks and findings and work with engineers and technical specialists to develop appropriate risk mitigation measures.
• Familiarity with cybersecurity assessments, vulnerability management, security testing or incident response would be an added advantage.
• Experience or knowledge of OT, industrial control systems, CII or other operationally critical environments would be an added advantage.
• Relevant professional certifications in cybersecurity, technology risk, audit, governance or OT cybersecurity would be an added advantage.
• Keen interest in OT cybersecurity, CII protection and the power sector.
• Strong analytical, communication and stakeholder management skills.