Lead Cybersecurity Consultant (Cybersecurity Certification Centre), CSEC

Cyber Security Agency of Singapore (CSA); Singapore; On-site; SGD 180,000 - 280,000; Full time

Job summary

Cyber Security Agency of Singapore (CSA) is seeking a senior Lead Technical Assessor to drive certification and labelling efforts across national schemes, while mentoring a team of experts in penetration testing and security evaluations.

You will shape technical competency, lead research, and partner with academia to translate findings into practical schemes for enterprise, IoT, and medical devices, strengthening Singapore's TIC ecosystem.

Qualifications

• Minimum 10-15 years in cybersecurity with at least 10 years in security evaluation, penetration testing, or product security assessment.
• Strong background in offensive security research and advanced testing techniques.
• Experience in developing custom tools, automation frameworks, or technical solutions for operational use.
• Product security assessment or security evaluation experience with familiar schemes preferred but not required.

Responsibilities

• Provide technical leadership for national cybersecurity evaluation schemes (NITES, Common Criteria, Cybersecurity Labelling Scheme).
• Mentor team in advanced penetration testing and security assessment methodologies.
• Develop technical competency frameworks and define security evaluation standards across product categories.
• Lead research initiatives, collaborate with academia, and translate findings into practical schemes.
• Build internal tools and automation to improve evaluation efficiency.

Skills

Cybersecurity

Security evaluation

Penetration testing

Product security assessment

Automation tooling

Mentoring

Communication skills

Threat assessment

Research

Education

Bachelor's degree in Engineering, Computer Science, Information Systems, Mathematics, or relevant technical discipline

Job description

What The Role Is

To provide technical leadership and capability development across national cybersecurity certification and labelling schemes (NITES, Common Criteria, Cybersecurity Labelling Scheme), while mentoring the team in advanced penetration testing methodologies, conducting critical technical assessments on emerging technologies, and serving as the Lead Technical Assessor for Enterprise Singapore's ISO/IEC 17025 Accreditation Programme to strengthen Singapore's Testing Inspection and Certification (TIC) Cyber ecosystem and maintain international standards of technical competency across approved testing laboratories.

What You Will Be Working On

• Technical Capability Development
• Develop and implement technical competency frameworks defining security evaluation standards across diverse product categories including enterprise systems, consumer IoT devices, and medical equipment
• Provide technical mentorship and build team's expertise in advanced testing methodologies and security assessment approaches for specialised domains including cryptographic implementations, network security solutions, IoT ecosystems, and medical device cybersecurity
• Drive research and development initiatives to identify real-world technical gaps, create innovative attack techniques and methodologies, set research directions, and collaborate with academia to ensure research outcomes are translatable into practical applications
• Build solutions for in-house use including tools for processing applications, AI-enabled testing tools, and automation systems to enhance evaluation efficiency and capabilities
• Conduct cutting-edge research into advanced attack vectors and techniques suitable for high-assurance security evaluations

Advanced Security Testing and Evaluation

• Provide technical leadership for complex evaluation projects across schemes
• Conduct advanced penetration testing and vulnerability assessments
• Apply newly developed attack techniques to complex evaluation projects
• Provide Approved Testing Laboratories with technical guidance on complex evaluations
• Validate the effectiveness of security controls against state-of-the-art attacks
• Develop custom testing approaches for novel product categories and emerging technologies, including conducting rapid technical assessments for emerging payment systems, fintech solutions, and digital services (such as Palm Pay and similar technologies)

Emerging Technology Assessment and Scheme Development

• Conduct technical assessments of emerging technologies for cybersecurity implications
• Research and analyse security requirements for new product categories/emerging technologies (such as AI/ML, quantum computing, 5G/6G, autonomous systems)
• Translate technical findings into practical scheme requirements
• Provide technical input for international standards development and mutual recognition arrangements
• Lead Singapore's initiative to harmonise cybersecurity requirements for Common Criteria evaluators and certifiers internationally
• Develop partnerships with academic institutions and industry for cybersecurity research
• Survey technological landscape and provide recommendations on key opportunities for new schemes

What We Are Looking For

• Minimum 10-15 years in the field of cybersecurity with at least 10 years in security evaluation, penetration testing, or product security assessment
• Bachelor's degree in Engineering, Computer Science, Information Systems, Mathematics, or relevant technical discipline
• Strong background in offensive security research, advanced penetration testing techniques, and security assessments of emerging technologies and novel systems
• Experience in conducting security assessments based on state-of-the-art security attack techniques
• Deep technical expertise in vulnerability analysis and penetration testing with proven ability to develop custom attack techniques, improvise published attacks, and conduct security assessments based on state-of-the-art security attack techniques
• Experience in developing custom tools, automation frameworks, or technical solutions for operational use
• Product security assessment or security evaluation experience (Common Criteria, or similar certification schemes preferred but not required
• Good mentoring and knowledge transfer abilities
• Strong communication skills for technical and non-technical audiences
• Ability to work under pressure
• Creative problem-solving and ability to think outside conventional approaches
• Team player with strong collaborative skills who is also able to work independently and take initiative on complex technical projects
• Applicant with Certified Ethical Hacker (CEH), Licensed Penetration Tester Master (LPT) Certification, Offensive Security Certified Professional (OSCP), GIAC Penetration Tester (GPEN) Certification, GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) Certification, CompTIA PenTest+ etc would be a plus.