IT Security Officer (ITSO) - #1756

JOBSTER PRIVATE LTD.; Singapore; On-site; SGD 110,000 - 180,000; Full time

Job summary

JOBSTER PRIVATE LTD. seeks an experienced cybersecurity professional to lead secure software development and risk assessment across cloud environments. You will review architectures, model threats, and drive remediation with CI/CD integration.

Responsibilities include incident response, vulnerability management and security training, working with stakeholders to strengthen security controls and adherence to ASVS/OWASP standards.

Qualifications

• At least 5 years combined work experience in software development, application security and cloud computing.
• Good understanding of mobile and web application architectures, including APIs and related technologies and protocols such as REST, SOAP and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including OWASP Top 10 and ASVS.
• Familiar with Agile development, CI/CD and DevSecOps practices, including tools such as GitLab, GitHub and Ansible, and the integration of automated security testing into CI/CD pipelines.
• Experience on using SAST code scanning tools such as Fortify-on-Demand, Sonarqube, etc
• Review system architecture, data flows, interfaces, APIs, internet-facing entry points and security controls to identify potential security risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure and cloud services.
• Preferably possess experience in threat modelling and develop threat profiles for application projects to identify, quantify and remediate application security risks.
• Review remediation plans and supporting evidence to verify that security risks have been adequately addressed.
• Track and address security vulnerabilities with timely remediation and patching and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorised access, and cloud security incidents.
• Perform cybersecurity incident response and management, including incident triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness training sessions to promote security awareness and good cybersecurity practices.
• Good verbal/written communications, collaboration skills and experience interacting with various stakeholders
• Strong analytical, problem-solving and troubleshooting skills, ability to work independently
• Degree in a relevant discipline, or an equivalent qualification.
• Relevant professional certifications such asCISSP, OSCP,CCSP, CRISC, AWS security certification or equivalent are preferred
• Experience in working with Government Commercial Cloud (GCC) preferred.

Responsibilities

• Review system architecture, data flows, interfaces and APIs to identify potential security risks.
• Conduct cybersecurity risk assessments for IT systems, applications and cloud services.
• Develop threat models and threat profiles for projects to quantify vulnerabilities.
• Verify remediation plans and evidence addressing security risks.
• Track vulnerabilities and ensure timely patching and closure.
• Monitor cybersecurity alerts and incidents and perform incident response.
• Deliver security awareness training and promote best practices.
• Collaborate with stakeholders to improve security posture.

Skills

Software development

Application security

Cloud computing

App architectures

REST APIs

SSL/TLS

OWASP Top 10

ASVS

CI/CD DevSecOps

SAST tools

Threat modelling

Incident response

Security awareness

Communication

Analytical skills

Independent work

Education

Bachelor's degree or equivalent

CISSP

OSCP

CCSP

CRISC

AWS Security Certification

Tools

Fortify-on-Demand

SonarQube

GitLab

GitHub

Ansible

Job description

Responsibilities and Requirements

• At least 5 years combined work experience in software development, application security and cloud computing (e.g. AWS)
• Good understanding of mobile and web application architectures, including APIs and related technologies and protocols such as REST, SOAP and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including the OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Familiar with Agile development, CI/CD and DevSecOps practices, including tools such as GitLab, GitHub and Ansible, and the integration of automated security testing into CI/CD pipelines.
• Experience on using SAST code scanning tools such as Fortify-on-Demand, Sonarqube, etc
• Review system architecture, data flows, interfaces, APIs, internet-facing entry points and security controls to identify potential security risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure and cloud services.
• Preferably possess experience in threat modelling and develop threat profiles for application projects to identify, quantify and remediate application security risks.
• Review remediation plans and supporting evidence to verify that security risks have been adequately addressed.
• Track and address security vulnerabilities with timely remediation and patching and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorised access, and cloud security incidents.
• Perform cybersecurity incident response and management, including incident triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness training sessions to promote security awareness and good cybersecurity practices.
• Good verbal/written communications, collaboration skills and experience interacting with various stakeholders
• Strong analytical, problem-solving and troubleshooting skills, ability to work independently
• Degree in a relevant discipline, or an equivalent qualification.
• Relevant professional certifications such asCISSP, OSCP,CCSP, CRISC, AWS security certification or equivalent are preferred
• Experience in working with Government Commercial Cloud (GCC) preferred.