IT Security Officer

HCL Technologies Limited; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

HCL Technologies Limited is seeking an experienced IT Security Officer to support cybersecurity across IT systems, applications, infrastructure, and cloud. You will conduct risk assessments, reviews, threat modelling, and incident response to ensure secure development lifecycles.

Responsibilities include risk assessments, threat modelling, vulnerability tracking, and integrating automated security testing into CI/CD and DevSecOps. Strong collaboration with developers and operations is essential.

Qualifications

• Degree in Cybersecurity, Computer Science, Information Technology, or related discipline.
• Minimum 5 years combined experience in software development, application security, and cloud computing (AWS).
• Strong knowledge of mobile/web app architectures, APIs, and protocols (REST/SOAP/TLS).
• Familiarity with Agile, CI/CD, and DevSecOps practices.
• Hands-on with SAST/code scanning tools and vulnerability management.

Responsibilities

• Conduct cybersecurity risk assessments for IT systems, apps, infrastructure, and cloud services.
• Review architecture, data flows, APIs, and security controls to identify risks.
• Assess mobile/web apps against security standards including OWASP Top 10/ASVS.
• Perform threat modelling and develop remediation recommendations.
• Track vulnerabilities and ensure timely remediation and closure.
• Support automated security testing within CI/CD/DevSecOps pipelines.
• Monitor incidents and conduct triage, containment, and post-incident reviews.
• Deliver security awareness sessions to stakeholders and project teams.

Skills

App security

Cloud security

Threat modelling

CI/CD / DevSecOps

SAST tools

OWASP ASVS

OWASP Top 10

GitLab / GitHub

Ansible

Vulnerability management

Incident response

REST / SOAP / TLS

Communication skills

Education

Degree in Cybersecurity

Equivalent qualification

Tools

Fortify on Demand

SonarQube

Job description

We are looking for an experienced IT Security Officer (ITSO) to support cybersecurity and application security activities across IT systems, applications, infrastructure, and cloud environments. The role will focus on security risk assessments, architecture reviews, vulnerability management, incident response, and ensuring security requirements are incorporated throughout the application development lifecycle.

Key Responsibilities

• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure, and cloud services.
• Review system architecture, data flows, interfaces, APIs, internet-facing entry points, and security controls to identify potential security risks and vulnerabilities.
• Assess mobile and web applications against application security principles, standards, and industry best practices.
• Perform threat modelling and develop threat profiles for application projects to identify, assess, and recommend remediation for security risks.
• Review remediation plans and supporting evidence to ensure identified security risks and vulnerabilities have been adequately addressed.
• Track security vulnerabilities and ensure timely remediation, patching, and closure in accordance with established security requirements.
• Support and review the integration of automated security testing within CI/CD and DevSecOps pipelines.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, compromised accounts, data breaches, unauthorized access, and cloud security incidents.
• Manage cybersecurity incidents through triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness sessions to promote good cybersecurity practices across stakeholders and project teams.
• Work closely with technical teams, application owners, developers, infrastructure teams, and other stakeholders to address cybersecurity risks and requirements.

Requirements

• Degree in Cybersecurity, Computer Science, Information Technology, or a related discipline, or an equivalent qualification.
• Minimum 5 years of combined experience in areas such as software development, application security, and cloud computing, including environments such as AWS.
• Strong understanding of mobile and web application architectures, APIs, and related technologies and protocols, including REST, SOAP, and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Familiarity with Agile development, CI/CD, and DevSecOps practices.
• Experience with tools and technologies such as GitLab, GitHub, and Ansible, including the integration of automated security testing into CI/CD pipelines.
• Hands-on experience with SAST/code scanning tools, such as Fortify on Demand, SonarQube, or equivalent.
• Experience in application security assessments, vulnerability management, cybersecurity risk assessment, and incident management.
• Strong analytical, troubleshooting, and problem-solving skills with the ability to work independently.
• Good written and verbal communication skills, with the ability to collaborate effectively with both technical and non-technical stakeholders.