GRC Lead — Cybersecurity Risk & Compliance

Assurity Trusted Solutions Pte Ltd; Singapore; On-site; SGD 120,000 - 180,000; Full time

Benefits offered by this job

GovTech affiliation

Learning culture

Contract staff benefits

Job summary

Assurity Trusted Solutions (ATS) is seeking a senior Cybersecurity & GRC leader to drive governance, risk, and compliance across GovTech-backed products and platforms. You will act as the de facto lead for GRC and the 2nd line of defence, partnering with Product teams to embed security, audit-ready evidence, and continuous improvement into delivery.

You will own Security Plan governance, automate evidence checks, and coordinate ICT audits with internal teams.

Qualifications

• 5+ years of experience in Cybersecurity in regulated/public-sector environment.
• Strong understanding of ICT governance and security controls across applications, infrastructure and SaaS.
• Strong understanding of product teams work (SDLC, agile delivery, cloud/SaaS usage) and where to embed controls.
• Comfortable acting as 2nd line of defence; independent challenge; collaborators with 1st line & 3rd line internal audit.
• Practical experience with enterprise issue-tracking and collaboration platforms; designing or maintaining workflows, dashboards for audit, risk or compliance.
• Strong policy writing skills; translate policies into playbooks, checklists and guidance.
• Experience in security awareness/training: phishing simulations, newsletters, talks.
• Comfortable working with automation/AI-enabled tools to scale GRC/audit.
• Excellent stakeholder management, influencing and negotiation skills, driving change toward evidence-driven audit.

Responsibilities

• Act as the de facto lead for GRC, shaping governance for risk and compliance across managed products and platforms.
• Operate as 2nd line of defence for ICT risk and controls with independent challenge on design and effectiveness.
• Partner with Product teams to embed security and compliance into delivery.
• Own governance and standards for Security Plan submissions across CIOO and product teams with templates and evidence expectations.
• Review Security Plans and supporting evidence; assess coverage and maturity; recommend approvals to stakeholders.
• Treat automation as an always-on audit; define evidence to check automatically; surface gaps and drive remediation.
• Track and report KPIs for Security Plan coverage, cycle time, and defect rates across CIOO and product teams.
• Design, implement, and own workflows for ICT audit, risk, and findings management.
• Structure and maintain knowledge/document spaces as the source of truth for ICT audit plans, procedures, control descriptions, and evidence repositories.
• Plan and execute thematic/product audits under CISO's direction; coordinate with internal audit and surface findings.
• Provide regular management reporting on audit status, risks and trends to CIOO leadership and CISO.
• Serve as author and custodian for GovTech-wide security policies (AI coding practices; SaaS usage; onboarding and clearance).
• Own policy lifecycle: drafting, stakeholder consultation, impact assessment, routing, publication, review.
• Translate policy into practical guidance for product teams and monitor policy adoption; escalate non-compliance.
• Lead SeTA for GovTech HQ; design campaigns (phishing simulations, newsletters, brown-bag sessions).
• Define and track SeTA KPIs and refine content based on insights.

Skills

Cybersecurity

ICT governance

SDLC & Agile

2nd line of defence

Policy writing

Security awareness

Automation tools

Stakeholder management

Issue-tracking tools

Job description

Assurity Trusted Solutions (ATS) is seeking a senior Cybersecurity & GRC leader to drive governance, risk, and compliance across GovTech-backed products and platforms. You will act as the de facto lead for GRC and the 2nd line of defence, partnering with Product teams to embed security, audit-ready evidence, and continuous improvement into delivery.

You will own Security Plan governance, automate evidence checks, and coordinate ICT audits with internal teams.