ITSO – IT Security Officer

ITCAN PTE. LIMITED; Singapore; On-site; SGD 60,000 - 120,000; Full time

Job summary

ITCAN PTE. LIMITED is seeking a cybersecurity professional with 3+ years of combined software development, application security, and cloud experience.

You will evaluate mobile/web architectures, APIs, and security controls while applying OWASP Top 10/ASVS and integrating automated security testing into CI/CD pipelines. The role involves threat modelling, risk assessments, incident response, and continuous security improvement across IT systems and cloud services.

Qualifications

• At least 3 years combined work experience in software development, application security and cloud computing.
• Good understanding of mobile and web application architectures, including APIs and related technologies and protocols such as REST, SOAP and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including the OWASP Top 10 and ASVS.
• Familiar with Agile development, CI/CD and DevSecOps practices, including tools such as GitLab, GitHub and Ansible, and the integration of automated security testing into CI/CD pipelines.
• Experience on using SAST code scanning tools such as Fortify-on-Demand, SonarQube, etc
• Review system architecture, data flows, interfaces, APIs,internet-facing entry points and security controls to identify potentialsecurity risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure and cloud services.
• Preferably possess experience in threat modelling and develop threat profiles for application projects to identify, quantify and remediate application security risks.
• Review remediation plans and supporting evidence to verify that security risks have been adequately addressed.
• Track and address security vulnerabilities with timely remediation and patching and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorised access, and cloud security incidents.
• Perform cybersecurity incident response and management, including incident triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness training sessions to promote security awareness and good cybersecurity practices.
• Good verbal/written communications, collaboration skills and experience interacting with various stakeholders
• Strong analytical, problem-solving and troubleshooting skills, ability to work independently
• Degree in a relevant discipline, or an equivalent qualification.
• Relevant professional certifications such as CISSP, OSCP,CCSP, CRISC, AWS security certification or equivalent are preferred
• Experience in working with Government Commercial Cloud(GCC) preferred.

Skills

Software development

Application security

Cloud computing

Mobile web apps

API protocols REST SOAP

OWASP ASVS

Agile CI/CD DevSecOps

Security testing tooling

Threat modelling

Security risk assessment

Incident response

Security awareness training

Stakeholder communication

Problem solving

Degree in a relevant discipline

Security certifications (CISSP OSCP CC

Education

CISSP

OSCP

CCSP

CRISC

AWS Security

Tools

Fortify on Demand

SonarQube

GitLab

GitHub

Ansible

Job description

Responsibilities and Requirements

• At least 3 years combined work experience in software development, application security and cloud computing (e.g. AWS)
• Good understanding of mobile and web application architectures, including APIs and related technologies and protocols such as REST, SOAP and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including the OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Familiar with Agile development, CI/CD and DevSecOps practices, including tools such as GitLab, GitHub and Ansible, and the integration of automated security testing into CI/CD pipelines.
• Experience on using SAST code scanning tools such as Fortify-on-Demand, SonarQube, etc
• Review system architecture, data flows, interfaces, APIs,internet-facing entry points and security controls to identify potentialsecurity risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure and cloud services.
• Preferably possess experience in threat modelling and develop threat profiles for application projects to identify, quantify and remediate application security risks.
• Review remediation plans and supporting evidence to verify that security risks have been adequately addressed.
• Track and address security vulnerabilities with timely remediation and patching and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorised access, and cloud security incidents.
• Perform cybersecurity incident response and management, including incident triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness training sessions to promote security awareness and good cybersecurity practices.
• Good verbal/written communications, collaboration skills and experience interacting with various stakeholders
• Strong analytical, problem-solving and troubleshooting skills, ability to work independently
• Degree in a relevant discipline, or an equivalent qualification.
• Relevant professional certifications such as CISSP, OSCP,CCSP, CRISC, AWS security certification or equivalent are preferred
• Experience in working with Government Commercial Cloud(GCC) preferred.