IT Security Officer – Vulnerability & Risk Management

SAGL Consulting; Singapore; Hybrid; SGD 80,000 - 140,000; Full time

Job summary

SAGL Consulting in Singapore is seeking an IT Security Officer specializing in Vulnerability Management and IT Risk Management to support a hybrid on‑premises and AWS environment.

You will own the vulnerability management lifecycle, maintain the IT Risk Register, drive remediation and risk acceptance activities, and provide risk‑based recommendations to technical and business stakeholders.

The role requires hands‑on experience with leading scanning tools and strong stakeholder communications.

Qualifications

• Experience in vulnerability management and IT risk management.
• Hands-on with vulnerability scanning tools: Tenable/Nessus, Qualys or Rapid7.
• Strong understanding of CVSS and risk-based prioritization.
• Experience maintaining Risk Registers and Risk Acceptance processes.
• Coordination with SMEs for remediation tracking.

Responsibilities

• Manage end-to-end vulnerability management lifecycle across on-premises and AWS.
• Run vulnerability scans and review findings to prioritize remediation.
• Maintain IT Risk Register with owners and treatment plans.
• Coordinate Risk Acceptance for unremediated risks.
• Prepare risk management dashboards and status reports.

Skills

Vulnerability management

IT security

Risk management

Stakeholder management

AWS security

Tools

Tenable/Nessus

Qualys

Rapid7

Job description

Role Overview

We are looking for an IT Security Officer specializing in Vulnerability Management and IT Risk Management to support a hybrid on-premises and AWS environment.

The role will own the vulnerability management lifecycle, maintain the IT Risk Register, drive remediation and risk acceptance activities, and provide risk-based recommendations to technical and business stakeholders.

Key Responsibilities

• Manage the end-to-end vulnerability management lifecycle across on-premises and AWS environments.
• Run and manage vulnerability scans using tools such as Tenable/Nessus, Qualys or Rapid7.
• Review vulnerability findings, assess their impact and prioritize remediation based on CVSS and business/technical context.
• Track remediation activities with infrastructure and application SMEs and escalates overdue vulnerabilities.
• Maintain the IT Risk Register and ensure risks, owners, treatment plans and status are current.
• Prepare and coordinate Risk Acceptance for vulnerabilities or risks that cannot be remediated within the required timeframe.
• Work with technical and business stakeholders to obtain risk acceptance approvals and periodically review accepted risks.
• Review vendor security advisories and determine their applicability and potential impact to the environment.
• Monitor security-update compliance for AV/EDR, IDS/IPS and similar security controls.
• Prepare vulnerability and risk management dashboards/status reports for management.
• Work across Security, Infrastructure, Cloud and Application teams to drive remediation and risk reduction.

Required Skills

• 3–5+ years of experience in Vulnerability Management, IT Security or Risk Management.
• Hands‑on experience with Tenable/Nessus, Qualys, Rapid7 or equivalent vulnerability scanning tools.
• Strong understanding of CVSS and risk-based vulnerability prioritization.
• Practical experience managing Risk Registers and Risk Acceptance processes.
• Strong experience in vulnerability remediation tracking and coordination with technical SMEs.
• Good understanding of on-premises infrastructure security covering servers, network devices and endpoints.
• Working knowledge of AWS security and the shared responsibility model, particularly EC2, S3, RDS, IAM and services such as Security Hub, GuardDuty and Inspector.
• Strong stakeholder management and communication skills.

Preferred

• Experience with GRC tools such as ServiceNow GRC or RSA Archer.
• Knowledge of NIST CSF, NIST 800-53 or ISO 27001.
• Relevant certifications such as Security+, CySA+, CISSP, CRISC or AWS Security Specialty.
• Experience supporting security/risk management in a hybrid cloud environment or managed-services/customer environment.