IT Security Officer

User Experience Researchers Pte Ltd; Singapore; Sur place; SGD 120 000 - 180 000; Plein temps

Résumé du poste

User Experience Researchers Pte Ltd in Singapore is seeking an experienced security professional to lead on system security, threat modelling, and incident response across applications and cloud services. You will assess risks, coordinate remediation, and drive secure software development practices with CI/CD enhancements.

The role requires strong collaboration with stakeholders, hands-on experience with SAST tools, and relevant certifications.

Qualifications

• At least 5 years combined work experience in software development, application security and cloud computing (e.g. AWS).
• Strong knowledge of REST, SOAP and SSL/TLS.
• Familiar with OWASP Top 10 and ASVS.
• Experience with CI/CD and DevSecOps, including automated security testing.
• Experience with SAST tools such as Fortify-on-Demand and SonarQube.
• Excellent communication and collaboration with stakeholders.
• Degree in a relevant discipline; professional certifications preferred (CISSP, OSCP, CCSP, CRISC, AWS security).
• Experience with Government Cloud/GCC preferred.

Responsabilités

• Review system architecture to identify security risks.
• Conduct cybersecurity risk assessments for IT systems, applications, infrastructure and cloud services.
• Conduct threat modelling and develop threat profiles for projects.
• Review remediation plans and evidence to verify risk addressed.
• Track vulnerabilities and coordinate remediation and patching.
• Monitor and investigate cybersecurity alerts and incidents.
• Perform incident response and post-incident review.
• Conduct security awareness training sessions.

Connaissances

Security risk assessment

Threat modelling

Incident response

CI/CD DevSecOps

SAST tools

Stakeholder communication

Analytical problem solving

Formation

Degree in a relevant discipline

CISSP

OSCP

CCSP

CRISC

AWS security certification

Outils

Fortify-on-Demand

SonarQube

GitLab

GitHub

Ansible

Description du poste

Key Responsibilities:

• Review system architecture, data flows, interfaces, APIs, internet-facing entry points and security controls to identify potential security risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure and cloud services.
• Conduct threat modelling and develop threat profiles for application projects to identify, quantify and remediate application security risks.
• Review remediation plans and supporting evidence to verify that security risks have been adequately addressed.
• Track and address security vulnerabilities with timely remediation and patching and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorised access, and cloud security incidents.
• Perform cybersecurity incident response and management, including incident triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness training sessions to promote security awareness and good cybersecurity practices.

Requirements:

• At least 5 years combined work experience in software development, application security and cloud computing (e.g. AWS).
• Good understanding of mobile and web application architectures, including APIs and related technologies and protocols such as REST, SOAP and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including the OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Familiar with Agile development, CI/CD and DevSecOps practices, including tools such as GitLab, GitHub and Ansible, and the integration of automated security testing into CI/CD pipelines.
• Experience using SAST code scanning tools such as Fortify-on-Demand, SonarQube, etc.
• Good verbal/written communication and collaboration skills, with experience interacting with various stakeholders.
• Strong analytical, problem-solving and troubleshooting skills, with the ability to work independently.
• Degree in a relevant discipline, or an equivalent qualification.
• Relevant professional certifications such as CISSP, OSCP, CCSP, CRISC, AWS security certification or equivalent are preferred.
• Experience in working with Government Commercial Cloud (GCC) preferred