Information Security (Vulnerability and Penetration )

Unison Group; Singapore; On-site; SGD 180,000 - 230,000; Full time

Job summary

Unison Group is seeking a senior security leader in Singapore to own vulnerability management, risk governance, and security engineering across business units. You will lead a team, coordinate with IT and security stakeholders, and drive risk-based vulnerability remediation.

The role requires hands-on PT, strong knowledge of OWASP, NIST, and CSPM tools, and experience managing external vendors. A relevant degree and advanced certifications are expected.

Qualifications

• Academic background in CS/IT preferred.
• Professional security certifications are highly regarded.
• Pen-testing certifications strongly viewed.

Skills

Security experience (7+ years)

InfoSec / IT risk management

Vulnerability management

Penetration testing governance

Leadership

Project management

Risk identification

Stakeholder communication

Process optimization

ITSM automation

Hands-on security engineering

CSPM solutions

Education

Bachelors in Computer Science or Information Technology

Security certifications (CISSP/CISM/CISA)

Penetration testing certifications (OSCP/GPEN/GWAPT/CREST/CEH)

Tools

Burp Suite

Nmap

Metasploit

Kali Linux

Cobalt Strike

Job description

Requirements

• Minimum 7 years of relevant security experience.
• Extensive experience in information security and/or IT risk management.
• Proven experience owning and running a vulnerability management and/or penetration testing program, process, and governance forum.
• Demonstrated leadership, project, and team-building skills, including the ability to lead teams and drive projects and initiatives across multiple departments.
• Ability to identify risks associated with business processes, operations, information security programs, and technology projects.
• Ability to communicate with diverse audiences, both technical and non-technical, to build consensus on risk-based vulnerability management and penetration testing.
• Experience with process optimization.
• Experience with process automation and workflow using ITSM tools.
• Hands-on experience with vulnerability management, penetration testing, and security engineering.
• Experience with industry-known vulnerability management, penetration testing, and CSPM solutions.

Vulnerability Management

• Strong knowledge of risk-based vulnerability management, including triage of vulnerabilities to determine "True Risk" exposure to Singlife.
• Experience in log configuration, formats, and feeding logs into SIEM platforms.

Penetration Testing

• Strong hands-on penetration testing background across multiple domains (network, web, mobile, API, and cloud), including managing external PT vendors and triaging and validating penetration test findings.
• Working knowledge of recognized penetration testing methodologies and frameworks (OWASP Testing Guide, PTES, NIST SP 800-115, MITRE ATT&CK) and common offensive tooling (e.g., Burp Suite, Nmap, Metasploit, Kali Linux, Cobalt Strike).
• Working knowledge of one or more programming/scripting languages such as Python, C++, Java, Ruby, Node, Go, and/or PowerShell.

Education

• Academic: Bachelor's degree in Computer Science or Information Technology (preferred).
• Professional Certification(s): One or more of CISSP, CISM, CISA, or SANS/GIAC certifications, together with a recognized penetration testing certification such as OSCP, GPEN, GWAPT, CREST (CRT/CCT), or CEH (preferred, or willing to become certified within one year).